# Sox compliance assessment
> Source: https://legalcode.md/skills/legalcode-sox-compliance-assessment | [HTML version](https://legalcode.md/skills/legalcode-sox-compliance-assessment)

SOX (Sarbanes-Oxley Act of 2002, Pub.

SOX (Sarbanes-Oxley Act of 2002, Pub. L. 107-204) compliance assessment for SEC-reporting companies covering Section 302 CEO/CFO disclosure controls and procedures (DC&P) certification (17 CFR § 240.13a-14), Section 404(a) management assessment of internal controls over financial reporting (ICFR) under the COSO 2013 Internal Control — Integrated Framework (5 components, 17 principles), Section 404(b) auditor attestation requirements (large accelerated filers and accelerated filers under PCAOB AS 2201), Section 301 audit committee independence and confidential whistleblower complaint procedures, Section 906 criminal certification obligations (18 U.S.C. § 1350), and Section 304/SEC Rule 10D-1 executive compensation clawback. Determines Section 404(b) applicability by filer category: large accelerated filer (≥$700M public float, §404(b) required), accelerated filer ($75M–$700M, §404(b) required), non-accelerated filer/SRC/EGC (§404(b) exempt). Assesses all four IT General Controls (ITGC) domains: access to programs and data, program change management, computer operations, and systems development/implementation. Evaluates SOC 1 Type II report reliance mechanics (SSAE 18/AT-C 320) including complementary user entity controls (CUECs), bridge letters, and carve-out vs. inclusive method for service organizations. Classifies deficiencies using PCAOB AS 2201 terminology: EFFECTIVE / CONTROL DEFICIENCY / SIGNIFICANT DEFICIENCY / MATERIAL WEAKNESS, with automatic Material Weakness triggers for fraud by senior management, prior-period restatement, auditor-detected material misstatement, and ineffective audit committee (AS 2201 §§ 69-70). Covers December 2023 SEC cybersecurity disclosure Rule (Form 8-K Item 1.05, 4-business-day reporting, Form 10-K governance disclosure) and its interaction with ICFR. Produces management's ICFR assessment documentation framework, deficiency remediation roadmap with IMMEDIATE/NEAR-TERM/BACKGROUND prioritization, and an annual SOX compliance calendar. Use when a public company must assess readiness for annual Section 302/404 certifications, when a material weakness has been identified or disclosed, when preparing for PCAOB audit or inspection, when transitioning from private to public company (IPO, de-SPAC), when material business changes require ICFR scope updates, or when building a SOX compliance program from scratch.

This skill assesses an organization's SOX compliance posture across four core domains: CEO/CFO certifications (Section 302), internal controls over financial reporting (Section 404), audit committee governance (Section 301), and criminal accountability provisions (Section 906). It supports both initial assessments and annual refresh cycles. **Covers:** - Filer category determination (large accelerated filer / accelerated filer / non-accelerated filer / SRC / EGC / FPI) and Section 404(b) applicability - Section 302 disclosure controls and procedures (DC&P) evaluation framework - COSO 2013 Internal Control — Integrated Framework: all 5 components, 17 principles - Entity-level controls (ELCs) — the foundation of ICFR - ICFR scope: significant accounts, locations, processes identification and risk ranking - Process-level control testing (design effectiveness and operating effectiveness) - IT General Controls (ITGC) across all four domains - SOC 1 Type II report reliance: CUEC testing, bridge letters, carve-out/inclusive method - Audit committee independence, financial expertise, and Section 301 complaint procedures - Deficiency classification per PCAOB AS 2201 §§ 7-9: control deficiency, significant deficiency, material weakness - Automatic material weakness triggers per AS 2201 §§ 69-70 - Remediation planning and status tracking for previously disclosed deficiencies - December 2023 SEC cybersecurity disclosure Rule (Form 8-K Item 1.05) ICFR interaction ...

## Jurisdictions

Global



---
*Legalcode -- legalcode.md*