SOX (Sarbanes-Oxley) Section 404 · Act of 2002 §404; COSO 2013 framework, 17 principles

SOX Section 404 is the obligation on a US issuer’s management to assess whether its internal control over financial reporting is effective, and to say so in the annual report. The Act publishes no control list, so that assessment is made against a recognized control framework — and the one issuers name is the COSO Internal Control—Integrated Framework (2013). That framework is Keel’s scope here, and the whole of it: the five components — control environment, risk assessment, control activities, information and communication, and monitoring activities — and all 17 principles beneath them, each written from the assessment angle of what an issuer has to be able to show. What is not modelled is said out loud rather than left to be discovered: the §302 and §906 officer certifications, the §404(b) auditor attestation, the process-level controls over revenue, procure-to-pay, payroll, the financial close and management estimates, and COSO’s points of focus. Scoring 100% here is an entity-level self-assessment against the principles, not a Section 404 conclusion — Keel is not an auditor and does not issue one.

Important: This is an entity-level self-assessment against the COSO 2013 principle set, not a Section 404 conclusion. Scoring 100% here means an implemented control is mapped to each of the seventeen principles; it is NOT a determination that internal control over financial reporting is effective, and it does not cover the process-level controls over revenue, procure-to-pay, payroll, the financial close and management estimates that a real 404 assessment scopes and tests, COSO’s points of focus, or the §302 and §906 officer certifications. Note who is subject to what: §404(a) — management’s own assessment — applies to every issuer, while the §404(b) auditor attestation is exempted for issuers that are neither large accelerated nor accelerated filers (15 U.S.C. 7262(c)) and for emerging growth companies. Keel’s summaries are paraphrase, not legal or accounting advice; if you are an SEC registrant, scope your assessment with your auditors.

Who needs SOX (Sarbanes-Oxley) Section 404?

• Newly public and pre-IPO companies facing management’s first assessment of internal control over financial reporting
• Finance, IT and internal audit teams who own the entity-level half of a 404 program and currently run it out of spreadsheets
• Private companies asked to demonstrate SOX-grade controls by an acquirer, a lender, or an issuer they supply

How Keel helps with SOX (Sarbanes-Oxley) Section 404

• All 17 principles as scored requirements under the five COSO components, each stating what you need to be able to show and the evidence that shows it
• 30 pre-mapped starter controls you can apply in one click, with every one of the 17 principles carrying at least one
• The technology general controls Principle 11 asks for — access and recertification, change management, operations, backup and restore — carried by the controls your security framework already needs, so that work is evidenced once instead of twice
• An owner, a status and dated evidence against each principle, so the entity-level assessment is a live record rather than something reconstructed at year end

Other frameworks: ISO/IEC 27001 · CIS Critical Security Controls · PCI DSS · SOC 2 · NIST Cybersecurity Framework · NIST SP 800-53 · All frameworks →