Entity-level controls operate across the organization and influence the effectiveness of many process-level controls. They…
Blog
Control Deficiency, Significant Deficiency, or Material Weakness?
A control deficiency is the broadest category. A significant deficiency is less severe than a…
When Cybersecurity Controls Become Relevant to SOX
A cybersecurity control becomes relevant to SOX when its failure could affect the reliability of…
SOX Testing: What Operating Effectiveness Actually Requires
Operating-effectiveness testing evaluates whether a control operated as designed during the relevant period, by people…
The De-SPAC SOX 404 Compliance Window
A de-SPAC merger takes a private company public in months, not years, and SOX 404…
SOX Readiness Assessment and What It Actually Covers
A SOX readiness assessment is the work you do before the auditor arrives, and its…
SOX 302 Certification and the Disclosure Committee Decision
SOX 302 is the quarterly and annual certification your CEO and CFO sign personally, and…
COSO Framework Applied to SOX Compliance
Auditors do not assess SOX 404 in a vacuum. They assess it against the COSO…
Segregation of Duties as a SOX Control Objective
Segregation of duties is one of the oldest ideas in internal controls, and under SOX…
SOX 404a vs 404b and the EGC-to-Accelerated-Filer Transition
SOX section 404 comes in two halves, and which half applies to your company depends…