SOX 404 Readiness: A Practical Checklist for Subsidiaries and First-Year Filers

Section 404 of the Sarbanes-Oxley Act requires management of US-listed companies to assess and report on the effectiveness of internal control over financial reporting (ICFR); for many filers, the external auditor must also attest to it. Through consolidation, the requirement reaches subsidiaries around the world — including many in Romania and Central and Eastern Europe.

Whether you are a newly acquired entity or a company preparing for a listing, the work follows a predictable path.

Phase 1 — Scoping

• Agree materiality and scoping thresholds with group finance
• Identify significant accounts and disclosures
• Map accounts to business processes and to the IT systems that support them
• Confirm which entities and locations are in scope
• Identify service organisations and obtain their SOC 1 reports

Phase 2 — Documentation

• Write process narratives or flowcharts for each in-scope process
• Identify risks of material misstatement (“what could go wrong”)
• Document key controls in a risk & control matrix: owner, frequency, type (manual/automated, preventive/detective), evidence
• Map controls to COSO 2013 components and principles, including entity-level controls
• Document IT general controls for every in-scope application, database and operating system

Phase 3 — IT general controls

ITGCs are where many first-year programmes struggle. Make sure you can evidence:

• Access to programs and data — user provisioning, removal of leavers, periodic access reviews, privileged access, segregation of duties
• Program change — changes requested, tested, approved and migrated by different people
• Computer operations — job scheduling, monitoring, backups and incident management
• Program development (where relevant) — controls over new system implementations and data migration

Phase 4 — Testing

• Perform walkthroughs to confirm design and implementation
• Agree sample sizes by control frequency with the external auditor
• Test operating effectiveness with documented, re-performable evidence
• Test key reports and spreadsheets used in controls (completeness and accuracy of information)

Phase 5 — Deficiencies and remediation

• Evaluate each exception: deficiency, significant deficiency or material weakness
• Identify root cause, not just the symptom
• Remediate early enough to allow re-testing before year-end
• Communicate significant deficiencies to the appropriate governance level

Practical advice from the field

• Fewer, better key controls. Over-scoping creates cost without assurance.
• Precision matters. A review control must say what is reviewed, against what threshold and how differences are followed up.
• Evidence is the control. If it is not documented, for the auditor it did not happen.
• Train control owners. Most failures are caused by people who do not know what “good evidence” looks like.

If you need independent testing, remediation support or a readiness assessment, see our SOX compliance service or the Internal Controls & SOX 404 Essentials course.