Standard

SOX 404 / ICFR

4 of the 19 clauses of SOX 404 / ICFR are cited by this register, on Account and nostro reconciliation, Audit evidence pack export, Board and committee pack, General ledger interface and sub-ledger post, Period-end close and journal review, Statutory filing and lodgement. Every one below is quoted from the copy we hold, with the hours it states where it states any.

SOX 404 ENT-2 Audit Committee Oversightnamed referencethe standard's page

The audit committee oversees ICFR, financial reporting, and external auditor independence with documented charter and meeting cadence.

What an assessor asks to see: audit committee charter; independence assessments; meeting minutes; agendas. Where it usually falls short: Audit Committee charter not refreshed when responsibilities change

SOX 404 ENT-8 Internal Audit Functionnamed referencethe standard's page

Internal audit reports functionally to the audit committee and executes risk-based audit plan covering ICFR.

What an assessor asks to see: IA charter; annual audit plan; audit reports; issue tracker. Where it usually falls short: Internal Audit plan not refreshed for changes in risk or business operations

SOX 404 SOX404-2 Period-End Financial Reporting Process (FRP)named referencethe standard's page

Per SOX 404: Period-End FRP including account reconciliations + close checklist + management review + significant estimates and judgments.

What an assessor asks to see: SOX 404 evidence for SOX404-2. Where it usually falls short: ELC + ITGC + deficiency partial

SOX 404 SOX404-4 IT General Controls (ITGC) - Access, Change, Operationsnamed referencethe standard's page

Per SOX 404 + COBIT: ITGC including access management + change management + computer operations + program development + backup + recovery.

What an assessor asks to see: SOX 404 evidence for SOX404-4. Where it usually falls short: ELC + ITGC + deficiency partial

Requirement text quoted from the standards themselves, published at compliance.theartofservice.com, the same publisher as this register, read against the held text of each standard: our statement of each clause, not the instrument verbatim. The whole standard on compliance.theartofservice.com.