SOX Readiness Assessment and What It Actually Covers

A SOX readiness assessment is the work you do before the auditor arrives, and its job is to find the gaps while you still have time to fix them. Companies that skip it walk into a 404 audit cold and pay for the discovery in audit fees and timeline. We explain what a readiness assessment actually includes below, who needs one, how long it takes, and what you should walk away with. It is the pre-hire view, not the service pitch.

What a SOX Readiness Assessment Is (and Who Needs One)

A readiness assessment is a structured review of your current controls against the 404 requirement, scoped to your filer status and your material accounts. It tells you what is already defensible, what needs documentation, and what needs to be redesigned before testing. The SOX readiness service page describes the engagement.

You need one if you are 12 to 24 months from a 404 audit and have not yet documented controls to auditor evidence standards, or if you are a newly-public company that filed under 404a and is approaching the 404b transition. You also need one if you have inherited a SOX program from an acquisition and have not confirmed it maps to your current scope.

What We Cover in a Readiness Engagement

We identify, assess, document, test, and implement internal control processes. The scope we run covers internal control remediation, risk assessments, the control matrix, scoping, and the implementation of policies and procedures. In practice that means we map your in-scope processes, build the risk-and-control matrix, identify the gaps between your current state and a defensible 404 program, and hand you the remediation plan in priority order.

The growth-stage SOX readiness page is the variant for companies scaling into accelerated-filer status, where the readiness work has to anticipate 404b, not just 404a.

How Long a Readiness Assessment Takes

A real readiness engagement runs weeks, not days, because the discovery has to be real. We scope in the first week, run the process mapping and gap analysis over the following weeks, and deliver the remediation plan on a schedule that fits your audit calendar. Companies that are 18 to 24 months out can run readiness as a paced program. Companies that are 6 to 12 months out run it as a compressed sprint, which is harder and costs more.

The SOX compliance checklist for audit readiness is the companion format, the phase-by-phase list that the readiness engagement works through.

What You Walk Away With

You walk away with three things. A scoped set of in-scope processes and material accounts, a roadmap to complete, and a prioritized remediation plan with the gaps ranked by audit risk. That is the deliverable, and it is what you hand the auditor, or what you use to decide whether you are ready to engage one.

How to Evaluate a SOX Readiness Consultant

The right question is not “how much” but “what do you scope against.” A consultant who scopes against a generic SOX template will over-document your immaterial processes and under-document the ones that matter. A consultant who scopes against your filer status and your material accounts will build a program that survives the audit. Our guide to evaluating SOX consulting options walks through the criteria, and the SOX for growth-stage tech companies page covers what that scoping looks like for a company like yours.

Tell us how far you are from your 404 audit and we will scope what a readiness assessment covers for your company. We run readiness as a scoped, structured engagement, and you can start with a scoping call. The SOX 404 overview is the right place to start if you want the full program context first.

FAQ

What is the SOX 404 assessment?

The SOX 404 assessment is management’s evaluation of whether internal control over financial reporting is effective, documented in the annual report. A readiness assessment is the pre-audit work that makes sure that evaluation will hold up when the auditor reviews it.

What is the SOX 404 document?

The SOX 404 document is the management report on internal control over financial reporting included in the annual filing, with the CEO and CFO certifications and, for 404b filers, the auditor’s attestation. A readiness engagement produces the evidence behind that document.

What is the difference between SOX 302 and SOX 404?

SOX 302 is the management certification of the financial statements, signed quarterly and annually by the CEO and CFO. SOX 404 is the management assessment of internal control over financial reporting, annual, with the auditor attestation added under 404b.

Is SOX compliance still required?

Yes. SOX 404 applies to all public companies in the United States subject to Securities and Exchange Commission (SEC) rules, with the 404a management assessment universal and the 404b auditor attestation tiered by filer status. EGCs and non-accelerated filers are exempt from 404b but not from 404a.

What does SOX stand for?

SOX stands for the Sarbanes-Oxley Act of 2002, the federal law that established management responsibility for internal control over financial reporting at public companies.