This is a reference library of 90 typical SOX key controls in eleven processes, from entity level to IT general controls. Each row is written the way a control should be written (who does what, when, to what, leaving what evidence) and carries its risk, financial statement assertions, nature, frequency and usual test. It is a starting point, not a standard list: no SEC rule and no PCAOB standard prescribes these controls.
“Key” is practitioner vocabulary. PCAOB Auditing Standard 2201 does not define it, and the SEC’s 2007 guidance for management (Release 33-8810) speaks instead of controls that “adequately address” the risk of a material misstatement. In practice a key control is one you test and rely on for a specific risk: the control, or one of a few, whose failure would let a material error in a relevant assertion go undetected. The selection method is in key vs non-key controls.
Use the library last, as a completeness check. The right set for a company comes out of its own scoping and risk assessment: its significant accounts, their relevant assertions and what could go wrong in its processes. A row that answers no risk you have is not key for you, and a risk you have that no row answers still needs a control. The rest of the program is on the SOX compliance hub.
In this guide
- How to read the tables
- Entity-level controls
- Financial close and reporting
- Revenue and receivables
- Purchasing and payables
- Payroll and benefits
- Inventory and cost of sales
- Fixed assets, leases and intangibles
- Treasury, debt and investments
- Income taxes
- Equity and stock compensation
- IT general controls
- Controls most often missing or weak
- How the list changes with company size
- How the list maps to COSO
- From a row to a testable description
- Questions readers ask
- Related guides
How to read the tables
- Control. About 25 words. A value in square brackets is yours to set; a number in brackets is an example, not a rule. A row that names a family (several accruals, several estimates) is one control per member in your matrix; “the ERP” is your accounting system. Your own version will usually run 40 to 80 words: it names the report, the threshold and the evidence (how to write a control description).
- Assertions. The five in PCAOB AS 1105 paragraph .11: E existence or occurrence, C completeness, V valuation or allocation, R rights and obligations, P presentation and disclosure. Paragraph .12 lets the auditor use a different set that is sufficient to identify potential misstatements; if your matrix carries accuracy and cut-off separately, map accuracy to V and cut-off to E and C. “Indirect” and “Monitoring” mark controls that support or check other controls, not an assertion.
- Nature and frequency. Preventive or detective, then manual, automated or IT-dependent manual (shown as “IT-dependent”). “Automated and manual” pairs a system rule with a person’s follow-up: two controls in your matrix, tested separately.
- How it is tested. The usual operating test. Sample sizes follow frequency by convention: annual 1; quarterly 2 of 4, or all 4 where risk is higher; monthly 2 to 5; weekly 5 to 15; daily 20 to 40; many times a day 25 to 60. No standard sets these numbers, and where the external auditor will rely on the work the auditor’s expectation governs (where the numbers come from). An automated control is tested once per configuration and then rests on the ITGCs (testing automated controls). An IT-dependent manual control also needs its report tested for completeness and accuracy, and a review control needs its precision tested, not only its sign-off.
PCAOB standards bind the external auditor. The SEC’s guidance is for management and says management need not identify every control in a process. COSO is the framework management chooses. The controls below are common practice under all three and required by none.
Entity-level controls
AS 2201 paragraph .24 lists the kinds of entity-level control; paragraph .23 separates those with an indirect effect from those that monitor other controls and the few precise enough to address a risk alone. Most rows here are indirect or monitoring controls: assessed, not sampled, and no substitute for a process-level test (see entity-level controls and, for EL-8, 302 sub-certifications).
| # | Control | Risk | Assertions | Nature and frequency | How it is tested |
|---|---|---|---|---|---|
| EL-1 | Each year every employee attests to the code of conduct in the learning system; compliance chases non-responders and reports completion to the audit committee. | Conduct rules are never acknowledged. | Indirect | Preventive; manual; annual | Inspect completion report, non-responder follow-up and committee minute. |
| EL-2 | The general counsel logs every hotline report and sends each accounting or control complaint, with its resolution, to the audit committee chair. | Accounting concerns never reach the committee. | Indirect | Detective; manual; each report | Trace accounting cases from log to committee and closure. |
| EL-3 | Before each filing the audit committee reviews the statements, significant judgments, open deficiencies and auditor communications; minutes record its questions and follow-up. | Management’s reporting goes unchallenged. | Monitoring | Detective; manual; quarterly | Inspect packs and minutes; confirm follow-ups closed. |
| EL-4 | Each year, and after an acquisition, new system or new revenue stream, the controller refreshes the financial reporting and fraud risk assessments; the CFO approves. | New risks have no control. | Indirect | Preventive; manual; annual | Inspect dated assessments; confirm changes reached the matrix. |
| EL-5 | Each year the CFO documents whether accounting and tax staff have the expertise the company’s transactions require and assesses each outside specialist relied on. | Complex accounting outruns staff expertise. | Indirect | Preventive; manual; annual | Inspect the assessment, resulting actions and review of specialists’ work. |
| EL-6 | Quarterly, internal audit examines support for every manual journal entry posted or approved by the CFO or controller and reports to the audit committee. | Senior management overrides controls. | E, V | Detective; IT-dependent; quarterly | Rebuild the extract from all journals; inspect selected work. |
| EL-7 | Quarterly, the controller matches the related party list from director and officer questionnaires to vendor and customer masters; the audit committee approves transactions found. | Related party transactions go undisclosed. | C, P | Detective; IT-dependent; quarterly | Reperform one quarter’s match; trace transactions to approval and disclosure. |
| EL-8 | Before each quarterly certification, unit heads and process owners sign sub-certifications on control changes, errors, fraud and unusual transactions; the controller logs every exception for the disclosure committee. | Known problems never reach the certifiers. | Indirect | Detective; manual; quarterly | Compare signers with the required list; trace exceptions to the committee’s minutes. |
| EL-9 | Before each 10-Q and 10-K the disclosure committee reviews the draft against the quarter’s events log (litigation, regulatory letters, deficiencies) and minutes its conclusions. | A material event goes undisclosed. | Monitoring; P | Detective; manual; quarterly | Inspect minutes and events log; confirm comments were cleared. |
| EL-10 | The SOX program office tests key controls to an annual plan, evaluates each deficiency with the controller and reports open deficiencies to the audit committee quarterly. | Control failures go unreported. | Monitoring | Detective; manual; quarterly | Agree the deficiency log to test results; inspect committee reports. |
Financial close and reporting
AS 2201 paragraph .26 describes the period-end financial reporting process and notes that at year-end its controls usually cannot be tested until after the as-of date. This is a short set: how to audit the financial close has a twelve-control starter matrix, and journal entry testing covers management override. FC-3 stands for every subledger-to-ledger reconciliation.
| # | Control | Risk | Assertions | Nature and frequency | How it is tested |
|---|---|---|---|---|---|
| FC-1 | The ERP holds each manual journal entry until a user other than the preparer, with an approval limit covering the amount, approves it. | Self-approved or unauthorized entries post. | E, V | Preventive; automated; each entry | Inspect rules and limits; attempt self-approval; search for entries outside workflow. |
| FC-2 | Approvers compare each manual entry with its support before approving; entries above [threshold] and all post-close or top-side entries also need the controller’s approval. | Unsupported entries are posted. | E, V, P | Preventive; manual; each entry | Sample from journals reconciled to the ledger: support, approver, timing. |
| FC-3 | Monthly, accountants reconcile each balance sheet account to a subledger or independent source; a second person reviews and escalates items over [threshold] or [N] days old. | Errors sit undetected in balances. | E, C, V | Detective; IT-dependent; monthly | Sample accounts, including all with aged items; reperform the ties. |
| FC-4 | For each significant estimate the preparer documents method, data and assumptions; the controller compares prior estimates with outcomes and challenges changes before the CFO approves. | Estimates are biased or wrong. | V | Detective; IT-dependent; quarterly | Reperform the review: data to source, assumptions, look-back. |
| FC-5 | Before recording, technical accounting documents each significant unusual transaction in a memo; the controller approves it and, quarterly, checks the list against board minutes and major contracts. | Unusual transactions are misrecorded or missed. | E, C, V, P | Preventive; manual; each transaction | Agree memo list to minutes and contracts; inspect memos and approval dates. |
| FC-6 | Entity accountants confirm intercompany balances in the matching tool by business day [N]; the consolidation accountant resolves differences over [tolerance] before eliminations post. | Intercompany differences distort the consolidation. | E, C, V | Detective; IT-dependent; monthly | Inspect match reports; trace differences to resolution. |
| FC-7 | The consolidation manager agrees each entity’s loaded trial balance to its ledger and translation rates to the approved source; the controller approves every top-side entry. | Loads, rates or top-side entries are wrong. | C, V, P | Detective; IT-dependent; monthly | Reperform load and rate checks; inspect every top-side entry. |
| FC-8 | Before results are released, the controller investigates account-level movements against prior period and budget above [amount and percent], corroborates explanations and logs conclusions. | A material error reaches reported results. | E, C, V | Detective; IT-dependent; monthly | Confirm every line over threshold was flagged; reperform selected investigations. |
| FC-9 | For each 10-Q and 10-K the reporting manager ties every amount in the draft to support and completes the disclosure checklist; the controller reviews both. | Filed statements or notes are wrong. | P, V, C | Detective; IT-dependent; quarterly | Reperform the tie-out for selected amounts; inspect checklist and comments. |
Revenue and receivables
Billing completeness, pricing, cut-off and the revenue estimates carry this process. See how to audit order-to-cash and revenue recognition.
| # | Control | Risk | Assertions | Nature and frequency | How it is tested |
|---|---|---|---|---|---|
| RV-1 | Staff outside sales create or change customer records only from a request approved by credit, which sets terms and limits. | Fictitious customers; unauthorized terms. | E, V | Preventive; manual; each change | Sample changes from the system log: request, approver, independence from sales. |
| RV-2 | Before recognition, revenue accounting documents obligations, price and timing for each new contract type and each contract over [threshold] or with non-standard terms; the revenue manager approves. | Revenue is misstated or mistimed. | E, C, V | Preventive; manual; each contract | Sample contracts and amendments; compare terms with review and entries. |
| RV-3 | The ERP prices each order line from the approved price master and holds any override beyond [tolerance] until sales finance approves it. | Invoices carry wrong prices. | V | Preventive; automated and manual; each order | Inspect rules; test overrides either side of tolerance; sample approvals. |
| RV-4 | The ERP creates each invoice from the shipment confirmation (quantity) and the order (price); product invoices cannot be keyed manually. | Shipments go unbilled or misbilled. | E, C, V | Preventive; automated; each shipment | Inspect configuration; trace one shipment to invoice; attempt manual entry. |
| RV-5 | Weekly and at period-end the billing supervisor clears every item on the shipped-not-invoiced report and accrues unbilled revenue, which the revenue manager approves. | Deliveries go unbilled and unrecorded. | C | Detective; IT-dependent; weekly | Sample weeks; trace report items to invoices or the accrual. |
| RV-6 | At each period-end the revenue accountant tests shipments [N] days either side against delivery terms and proof of delivery and adjusts revenue; the revenue manager reviews. | Revenue falls in the wrong period. | E, C | Detective; IT-dependent; monthly | Reperform for selected shipments and credits either side of period-end. |
| RV-7 | The ERP routes each credit memo and its support, by amount, to an approver other than the issuer or sales representative; unapproved memos cannot post. | Credits hide fictitious sales or theft. | E, V | Preventive; automated and manual; each credit | Inspect routing; attempt issuer approval; sample large credits for support. |
| RV-8 | Quarterly, revenue accounting estimates rebates, returns and other variable consideration by the documented method and compares prior accruals with actual claims; the controller reviews. | Rebates and returns are under-accrued. | V, C | Detective; IT-dependent; quarterly | Reperform calculation and look-back; agree inputs to agreements and claims. |
| RV-9 | Monthly, the revenue accountant rolls deferred and unbilled balances forward, agrees them to the ledger and investigates unbilled items over [60] days; the revenue manager reviews. | Deferred revenue is released wrongly. | E, C, V | Detective; IT-dependent; monthly | Reperform the roll-forward; recalculate recognition for selected contracts. |
| RV-10 | Quarterly, the credit manager calculates the allowance from the aging report by the documented method, with specific reserves over [threshold]; the controller reviews rates against write-off history, current conditions and forecasts. | Receivables exceed what is collectible. | V | Detective; IT-dependent; quarterly | Reperform the calculation; compare prior allowances with later write-offs. |
Purchasing and payables
The three-way match covers most invoice risks at once, and vendor master changes are the main fraud route. The full chain is in how to audit procure-to-pay.
| # | Control | Risk | Assertions | Nature and frequency | How it is tested |
|---|---|---|---|---|---|
| PP-1 | Staff outside payables change vendor records only from an approved request; bank changes also need a call-back to a number already on file and a second approver. | Payments reach fictitious or redirected accounts. | E | Preventive; manual; each change | Sample log changes, mostly bank changes: request, call-back, approver. |
| PP-2 | The ERP routes each requisition and purchase order to approvers set by the delegation of authority, never the requester; no order is released unapproved. | Purchases are committed without authority. | E | Preventive; automated; each order | Agree workflow limits to the delegation; test either side of a limit. |
| PP-3 | The ERP matches each invoice to purchase order and receipt and blocks payment when price or quantity differs by more than [tolerance]. | Unreceived goods or wrong amounts are paid. | E, V | Preventive; automated; each invoice | Inspect match settings; test invoices either side of tolerance. |
| PP-4 | Only the payables supervisor can release a blocked invoice, recording the reason; monthly, the controller reviews the release log for concentration by user and vendor. | Match failures are overridden without cause. | E, V | Detective; IT-dependent; monthly | Inspect release rights and log reviews; trace selected releases to support. |
| PP-5 | Invoices without a purchase order are approved in workflow by the budget holder, within delegation limits, before payables can post them. | Unauthorized expenses are recorded. | E, V, P | Preventive; manual; each invoice | Sample these invoices: approver, limit, coding, support. |
| PP-6 | The ERP rejects any invoice whose vendor, invoice number, date and amount match one already entered. | An invoice is paid twice. | E | Preventive; automated; each invoice | Inspect the rule; enter a duplicate in a test environment; search all invoices for duplicates. |
| PP-7 | For each payment run a treasury releaser who cannot enter invoices or change vendors agrees the bank file’s total and count to the approved proposal. | Payments are added, altered or unauthorized. | E | Preventive; IT-dependent; each run | Sample runs: agree proposal, bank file and statement; check releaser access. |
| PP-8 | At each period-end the payables accountant accrues goods received not invoiced and searches later invoices and payments above [threshold] for unrecorded liabilities; the controller reviews. | Liabilities and expenses are understated. | C | Detective; IT-dependent; monthly | Reperform the search on selected later invoices and payments. |
Payroll and benefits
Master data changes are where payroll errors and fraud enter; the run-to-run review catches what change controls miss. See how to audit payroll. PY-8 applies to every service organization in scope: see how to review a SOC 1 report and SOC 1 bridge letters.
| # | Control | Risk | Assertions | Nature and frequency | How it is tested |
|---|---|---|---|---|---|
| PY-1 | Hires, rate changes and terminations enter the HR system only from requests approved in workflow by the manager and HR; payroll staff cannot change master data. | Fictitious employees or unauthorized pay. | E, V | Preventive; manual; each change | Sample the HR change log: approver, source document, user who keyed it. |
| PY-2 | Before each run the payroll supervisor agrees the change report (hires, terminations, rate and bank changes) to approved HR actions and clears interface exceptions. | Unapproved or missed changes are paid. | E, C, V | Detective; IT-dependent; each run | Sample runs; trace changes both ways between report and approvals. |
| PY-3 | Managers approve time records before each run’s cut-off; the timekeeping system blocks self-approval and logs delegations. | Hours not worked are paid. | E | Preventive; automated and manual; each run | Attempt self-approval; sample hourly staff’s time records: approver, timing, delegation. |
| PY-4 | Before each run is released the payroll manager investigates movements from the prior run above [threshold], by employee and cost center, and documents explanations. | Pay errors or fraud go unseen. | E, V | Detective; IT-dependent; each run | Sample runs; confirm every movement over threshold was explained. |
| PY-5 | Monthly, the payroll accountant reconciles register totals (gross pay, taxes, deductions) to the ledger and to funding debits at the bank; the assistant controller reviews. | Payroll expense and liabilities are misstated. | E, C, V | Detective; IT-dependent; monthly | Reperform the tie of register to ledger and bank. |
| PY-6 | Quarterly, the compensation accountant calculates bonus, commission and paid-leave accruals from plan terms and attainment data confirmed by HR; the controller compares prior accruals with payouts. | Compensation accruals are misstated. | C, V | Detective; IT-dependent; quarterly | Reperform the calculation; agree inputs to plans and HR data. |
| PY-7 | Each year the controller reviews the actuary’s valuation of benefit obligations: census data to HR records, assumptions to CFO approval, results to entries and disclosures. | Benefit obligations are misstated. | V, C, P | Detective; IT-dependent; annual | Inspect the review; reperform the census tie-out for a selection. |
| PY-8 | Yearly, the payroll manager reviews the provider’s SOC 1 Type 2 report (period, opinion, exceptions), maps each complementary user entity control to a tested control and obtains a bridge letter. | Provider or user-side failures go unseen. | Indirect | Detective; manual; annual | Inspect the review memo; reperform the mapping to tested controls. |
Inventory and cost of sales
Existence rests on counts and adjustments; valuation on the cost roll, variances and reserves. See how to audit inventory.
| # | Control | Risk | Assertions | Nature and frequency | How it is tested |
|---|---|---|---|---|---|
| IN-1 | Receivers independent of purchasing scan each receipt against the open purchase order line; the ERP blocks quantities above the order beyond [tolerance]. | Unreceived goods are recorded as inventory. | E, C | Preventive; automated and manual; each receipt | Sample receipts to carrier documents and order; inspect the over-receipt setting. |
| IN-2 | Counters independent of custodians count high-value (A) items monthly, B quarterly and C annually, blind to system quantities; variances over [tolerance] are recounted before adjustment. | Recorded inventory does not exist. | E, C | Detective; manual; monthly | Observe a count; test floor-to-list and list-to-floor; inspect coverage and recounts. |
| IN-3 | Adjustments need a reason code, approval outside the warehouse and, above [threshold], finance approval; monthly, the plant controller reviews the log by reason, poster and location. | Shrinkage hides in adjustments. | E, V | Detective; IT-dependent; monthly | Sample adjustments, with all above threshold: approval, investigation, log review. |
| IN-4 | On shipment confirmation the ERP relieves inventory and records cost of sales at standard cost in the same period as the invoice. | Cost and revenue land in different periods. | E, C | Preventive; automated; each shipment | Inspect configuration; trace one shipment to inventory, cost of sales and invoice. |
| IN-5 | Each year cost accounting rebuilds standard costs from current bills of material, routings, purchase prices and overhead rates; the controller approves the cost roll and revaluation entry. | Inventory sits at outdated cost. | V | Preventive; IT-dependent; annual | Recalculate selected standards; agree the revaluation to the ledger. |
| IN-6 | Monthly, the cost accountant investigates purchase price and production variances above [threshold] and capitalizes variances into inventory by the documented method; the controller reviews. | Standard cost drifts from actual cost. | V | Detective; IT-dependent; monthly | Reperform the capitalization; inspect variance investigations. |
| IN-7 | Quarterly, cost accounting recalculates the excess and obsolete reserve from usage and aging reports by the documented method and tests net realizable value; the controller reviews specific reserves. | Inventory exceeds what it will realize. | V | Detective; IT-dependent; quarterly | Reperform one quarter’s reserve; compare prior reserves with later write-offs. |
| IN-8 | Quarterly, inventory control agrees quantities confirmed by third-party warehouses and consignees to perpetual records and counts each outside location at least annually. | Stock held by others is misstated. | E, R | Detective; IT-dependent; quarterly | Inspect confirmations, reconciliations and outside counts. |
Fixed assets, leases and intangibles
Capitalization and impairment are judgments, depreciation is a large automated calculation, and leases are a completeness problem. See how to audit fixed assets.
| # | Control | Risk | Assertions | Nature and frequency | How it is tested |
|---|---|---|---|---|---|
| FA-1 | Capital requests are approved against a business case and budget, at the delegation of authority level for the amount, before any commitment. | Capital spending is unauthorized. | E | Preventive; manual; each request | Sample additions; trace to a request approved before the order date. |
| FA-2 | Monthly, the fixed asset accountant reviews invoices above [threshold] coded to capital and to repairs against the capitalization policy and corrects miscoding; the assistant controller reviews. | Expenses are capitalized or assets expensed. | E, C, P | Detective; IT-dependent; monthly | Reperform the review for a selection in both directions. |
| FA-3 | Monthly, the fixed asset accountant reviews construction in progress with project managers, transfers completed projects to service and refers stalled ones for write-off review. | Finished assets go undepreciated; dead projects linger. | V, E | Detective; IT-dependent; monthly | Age the account; trace old projects and selected transfers to in-service evidence. |
| FA-4 | The asset system calculates depreciation from each asset class’s life and method; the fixed asset accountant agrees each addition’s class, cost and in-service date to support. | Depreciation uses wrong lives or dates. | V | Preventive; automated and manual; monthly | Agree class settings to policy; recalculate depreciation; sample additions. |
| FA-5 | Disposals are approved before the event at the level set for book value; the fixed asset accountant removes the asset and records the gain or loss. | Disposals are unapproved or left on the books. | E, V | Preventive; manual; each disposal | Sample disposals: prior approval, removal from register, gain or loss. |
| FA-6 | Quarterly, the controller completes an impairment indicator checklist with operations input (idle assets, losses, reduced forecasts) and documents an assessment wherever an indicator exists; the CFO approves. | Impaired assets stay at full value. | V | Detective; manual; quarterly | Inspect checklists; independently identify idle or loss-making assets. |
| FA-7 | Quarterly, the lease accountant collects new and modified contracts from procurement, legal and real estate, agrees each lease’s term and payments to the contract and its discount rate to treasury’s approved rates. | Leases are unrecorded or measured wrongly. | C, V, R | Detective; manual; quarterly | Compare lease list with rent payments and contracts; recalculate a selection. |
| FA-8 | Each year, and when an indicator arises, the controller tests goodwill and indefinite-lived intangibles for impairment from board-approved forecasts; the CFO approves growth and discount rates. | Goodwill or intangibles are overstated. | V | Detective; IT-dependent; annual | Agree forecasts to the approved plan and rates to support; compare past forecasts with results. |
Treasury, debt and investments
Errors and theft surface first in cash; debt and investments add classification and valuation. See how to audit treasury.
| # | Control | Risk | Assertions | Nature and frequency | How it is tested |
|---|---|---|---|---|---|
| TR-1 | Bank accounts open and close only with CFO approval; yearly, treasury confirms accounts and signatories with every bank, and leavers come off mandates within [five] business days. | Unrecorded accounts; stale signatories. | E, C, R | Preventive; manual; each change | Compare bank-supplied account and signatory lists with ledger, approvals and HR leavers. |
| TR-2 | The banking platform requires a second user, within a role limit, to release each payment above [threshold]; no user can both initiate and release. | Unauthorized payments leave the bank. | E | Preventive; automated; each payment | Inspect entitlements and limits; sample payments for distinct initiator and releaser. |
| TR-3 | Monthly, an accountant with no payment duties reconciles each bank account to the ledger; the assistant controller reviews and escalates items older than [30] days. | Cash errors or theft go unseen. | E, C | Detective; IT-dependent; monthly | Agree to bank statement and ledger; trace reconciling items to clearance. |
| TR-4 | Monthly, the treasury accountant agrees debt to lender statements, recalculates interest and fee amortization and checks current versus non-current classification; the assistant controller reviews. | Debt, interest or classification is misstated. | C, V, P | Detective; manual; monthly | Agree balances to lender statements; recalculate interest; check classification. |
| TR-5 | Quarterly, treasury calculates covenants using the agreement’s definitions; the controller reviews the calculation independently before the compliance certificate is signed and assesses classification and disclosure. | A breach is missed; debt is misclassified. | P | Detective; manual; quarterly | Reperform from the agreement’s definitions; inspect the classification assessment. |
| TR-6 | Monthly, the treasury accountant agrees investment holdings and fair values to custodian statements and reprices a selection from an independent source; quarterly, the controller reviews classification and unrealized losses. | Investments are misvalued or misclassified. | E, V, R, P | Detective; manual; monthly | Agree holdings to custodian statements; reprice a selection. |
| TR-7 | Treasury documents each hedge designation at inception; someone other than the dealer confirms each deal; each reporting date treasury assesses effectiveness and agrees fair values to counterparty statements. | Derivatives or hedge accounting are wrong. | V, P, C | Detective; manual; quarterly | Compare documentation dates with trade dates; reperform effectiveness and valuation. |
Income taxes
A few quarterly, judgment-heavy review controls run by specialists, usually in spreadsheets (see end-user computing). TX-2 applies to any spreadsheet a key control depends on; the competence question is EL-5.
| # | Control | Risk | Assertions | Nature and frequency | How it is tested |
|---|---|---|---|---|---|
| TX-1 | Quarterly, the tax manager agrees pre-tax income by entity in the provision workbook to the consolidation system before computing the provision. | The provision starts from wrong income. | C, V | Detective; IT-dependent; quarterly | Reperform the tie-out. |
| TX-2 | The provision workbook sits in a restricted folder with formula cells locked; quarterly, the tax director reviews the log of every change to formulas or structure. | Spreadsheet errors corrupt the provision. | V | Preventive; manual; quarterly | Inspect access, cell protection and change log; recalculate key formulas. |
| TX-3 | Quarterly, the tax director reviews the provision (the estimated annual rate and discrete items at interim; book-tax differences, enacted rates and the rate reconciliation at year-end) and records questions and resolutions. | Current or deferred tax is misstated. | V, C, P | Detective; IT-dependent; quarterly | Reperform the review; recalculate the rate reconciliation. |
| TX-4 | When returns are filed the tax manager reconciles return to provision and rolls deferred balances to the tax-basis balance sheet; true-ups above [threshold] are explained to the controller. | Deferred taxes do not match basis differences. | E, C, V | Detective; manual; annual | Inspect reconciliation and roll-forward; trace true-ups to entries. |
| TX-5 | Quarterly, the tax director documents by jurisdiction the evidence for realizing deferred tax assets, using the forecasts used for budgeting and impairment; the CFO approves the valuation allowance. | Deferred tax assets are not realizable. | V | Detective; manual; quarterly | Agree forecasts to approved budgets; compare prior forecasts with results. |
| TX-6 | Quarterly, the tax director updates the uncertain tax position inventory for new positions, audit developments and expired statutes and documents recognition and measurement; the CFO reviews. | Tax exposures are unrecorded or undisclosed. | C, V, P | Detective; manual; quarterly | Compare the inventory with tax authority correspondence and advisers’ memos. |
| TX-7 | Quarterly, the tax accountant reconciles income taxes payable and receivable by jurisdiction to returns, payments and the provision; the tax manager reviews. | Taxes payable are misstated. | E, C, V | Detective; manual; quarterly | Reperform; agree payments to bank records. |
Equity and stock compensation
Equity runs on two outside records, the stock plan administrator’s system and the transfer agent’s register, so PY-8 applies to both. Populations are small (testing controls in small populations).
| # | Control | Risk | Assertions | Nature and frequency | How it is tested |
|---|---|---|---|---|---|
| EQ-1 | The compensation committee approves every equity grant by resolution; quarterly, the equity accountant agrees the equity system’s new-grant report to the resolutions. | Grants are unauthorized, unrecorded or misdated. | E, C | Detective; IT-dependent; quarterly | Agree the grant report to resolutions both ways: recipient, shares, date, vesting. |
| EQ-2 | For each grant the equity accountant documents fair value inputs (share price, volatility, expected term, risk-free rate) with sources; the controller approves and reassesses performance-condition probability quarterly. | Fair value or expected vesting is wrong. | V | Preventive; manual; each grant | Sample grants; agree inputs to sources; recalculate fair value. |
| EQ-3 | Quarterly, the equity accountant rolls awards forward (granted, vested, exercised, forfeited), agrees expense per the equity system to the ledger and recalculates a selection; the controller reviews. | Stock compensation expense is misstated. | V, C | Detective; IT-dependent; quarterly | Reperform the roll-forward; recalculate expense for selected awards. |
| EQ-4 | Quarterly, the equity accountant agrees forfeitures in the equity system to the HR termination report. | Expense continues on forfeited awards. | V, E | Detective; IT-dependent; quarterly | Compare HR terminations with recorded forfeitures. |
| EQ-5 | Quarterly, the equity accountant reconciles shares outstanding per the transfer agent to the equity system and the ledger’s share capital roll-forward; the controller reviews. | Share counts and equity balances are wrong. | E, C, R | Detective; IT-dependent; quarterly | Reperform from the transfer agent statement. |
| EQ-6 | Treasury executes repurchases and dividends only within board authorizations; the treasury accountant agrees each to broker or transfer agent statements and the total to the authorization. | Equity transactions are unauthorized or misrecorded. | E, V, P | Detective; manual; each transaction | Agree repurchases and dividends to minutes, statements and entries. |
| EQ-7 | Quarterly, the reporting manager calculates basic and diluted earnings per share from the reconciled share data; the controller recalculates weighted average shares and dilution. | Earnings per share is misstated. | V, P | Detective; manual; quarterly | Reperform the calculation from reconciled share and award data. |
IT general controls
ITGCs address no assertion; they are in scope because automated controls, system reports and system-enforced segregation depend on them. This is a short set: the ITGC primer has the full 24-control test matrix, including backups and development controls, and SOX ITGC scoping decides which systems are in.
| # | Control | Risk | Assertions | Nature and frequency | How it is tested |
|---|---|---|---|---|---|
| IT-1 | IT grants or changes access to in-scope applications only on a ticket approved by the user’s manager and the role owner, and only for the roles approved. | Users hold inappropriate access. | Indirect | Preventive; manual; each request | Sample new and changed accounts from a system listing; agree roles to tickets. |
| IT-2 | The HR termination feed disables network accounts on the last working day; IT removes application access within [N] business days from the daily termination report. | Leavers keep system access. | Indirect | Preventive; automated and manual; daily | Compare all HR leavers with account status and last logon, by layer. |
| IT-3 | Quarterly, business owners review every user and role on listings IT has agreed to the system and mark keep or remove; IT completes removals within [N] business days. | Inappropriate access accumulates unnoticed. | Indirect | Detective; IT-dependent; quarterly | Test listing completeness, reviewer responses and removals. |
| IT-4 | Administrator and database write access is limited to named IT staff on separate accounts; shared accounts are vaulted; a manager without such access reviews privileged activity logs monthly. | Privileged users bypass application controls. | Indirect | Detective; IT-dependent; monthly | Test all privileged accounts, by layer, against approval; inspect vault and log reviews. |
| IT-5 | Quarterly, the security administrator runs the conflict report against the approved segregation of duties ruleset; each conflict is removed or tied to a named mitigating control the controller approves. | Conflicting duties sit with one user. | Indirect | Detective; IT-dependent; quarterly | Rerun the analysis; test each conflict for removal or working mitigation. |
| IT-6 | Every change to in-scope applications, reports, interfaces and configuration is tested, accepted by the business owner and approved by the IT manager before deployment. | Untested or unauthorized changes alter processing. | Indirect | Preventive; manual; each change | Reconcile deployment log to tickets both ways; sample for test and approval dates. |
| IT-7 | Developers hold no deployment rights to production; a release role deploys, and repository branch protection requires a second person’s review. | Developers deploy their own unreviewed code. | Indirect | Preventive; automated; each change | Compare deploy rights with the developer list; inspect branch protection and bypass list. |
| IT-8 | The scheduler alerts IT operations to every failed financial job or interface; operations logs a ticket, resolves it the same day and agrees control totals between systems. | Failed jobs drop or duplicate data. | Indirect | Detective; automated and manual; daily | Take failures from the scheduler log; inspect tickets and control totals. |
Controls most often missing or weak
The Material Weakness Tracker (Q3 2026 edition) covers 904 companies that disclosed a material weakness in 10-K and 10-Q filings made between July 1 and September 30, 2026. The most-cited causes were segregation of duties (464 companies, 51%), accounting staff and expertise (417, 46%), control environment and oversight (306, 34%), financial close and reporting (260, 29%) and review controls and evidence (235, 26%); a company can cite several. Among large accelerated and accelerated filers with a weakness, IT general controls were the most common cause (43%).
Those are disclosed causes. Which rows fail in testing is a narrower question, and the table is practitioner judgment, not data. Its first two lines are also subjects of PCAOB Staff Audit Practice Alert No. 11 (October 2013; staff guidance for auditors, not a standard).
| Weak spot | Rows | What is usually wrong |
|---|---|---|
| Review controls with no stated precision | FC-4, FC-8, RV-10, IN-7, TX-3 | The threshold is unwritten or larger than the error that matters; the only evidence is a signature. |
| Reports nobody tested | Every IT-dependent manual row | The review was sampled; the report’s completeness, accuracy and parameters never were. |
| Non-routine transactions | FC-5, EL-5 | Nothing brings a new deal, contract type or financing to accounting before it is booked. |
| The human half of a system control | FC-2, PP-4, RV-3, RV-7 | The workflow was tested once; overrides, releases and approvals were never sampled. |
| Segregation resting on untested mitigation | IT-5, PP-1, PP-7, PY-1 | Conflicts are accepted against a mitigating control nobody tests. |
| Populations taken from the wrong list | IT-2, IT-6 | Leavers are tested from IT’s list, not HR’s; changes are sampled from tickets, so a change with no ticket is never selected. |
| The user side of a service organization | PY-8 | The SOC 1 report is filed unread; the complementary user entity controls map to nothing. |
How the list changes with company size
The eleven processes apply at any size. What changes is who performs each control, how it is evidenced and how many versions of it exist. For the auditor, AS 2201 paragraph .13 treats scaling as part of the risk-based approach, and COSO accepts that a smaller entity’s internal control can be less formal and still effective. The comparison is practice, on the filer categories in force in November 2026 (404(a) vs 404(b)).
| Dimension | Small non-accelerated filer | Multi-location large accelerated filer |
|---|---|---|
| Who assesses | Management only; no auditor attestation | Management’s assessment plus the auditor’s opinion under AS 2201; the auditor chooses its own controls to test |
| Shape of the list | Fewer, broader controls; the CFO or controller performs many reviews personally | The same control repeated by location, entity and system; locations scoped by risk (for the auditor, AS 2201 Appendix B), shared service controls scoped once |
| Segregation of duties | Often not achievable: detective reviews by someone outside the process (FC-8, PP-4, PY-4) and override controls (EL-6) carry more weight; a note to AS 2201 paragraph .24 says override controls can matter especially at smaller companies | Enforced in the system and monitored (IT-5) |
| Evidence | The SEC’s guidance says daily interaction with controls may give management enough evidence where their operation is centralized and few people are involved; document how it did | Each instance leaves evidence a tester can read without asking the performer |
| IT | Packaged, often hosted software with little customization: the access rows, vendor releases and PY-8 for the host | Several ERPs, interfaces and custom reports: every IT row for each system and layer |
Two SEC proposals of May 2026 would change this backdrop: one would cut the main filer categories to two and leave the auditor’s attestation to large accelerated filers (Release 33-11419); the other would allow semiannual in place of quarterly reports (Release 33-11414), which would bear on the rows tied to each 10-Q. Both were proposed, not final, as of November 2026: work to the rules in force and re-check before relying on either.
How the list maps to COSO
Management assesses against a framework, usually COSO’s 2013 Internal Control — Integrated Framework, whose executive summary says an effective system needs each of the five components and relevant principles “present and functioning”. A control library is mostly control activities, so the mapping shows where this one is thin: principles 5 (accountability) and 12 (policies) have no row of their own (the 17 principles).
| Component | Principles | Where it shows up in the list |
|---|---|---|
| Control environment | 1 to 5 | EL-1 and EL-2 (1), EL-3 (2), the delegation limits behind FC-1 and PP-2 (3), EL-5 (4) |
| Risk assessment | 6 to 9 | EL-4 (6, 7, 9); EL-4, EL-6 and EL-7 for fraud risk (8); FC-5 for significant change (9) |
| Control activities | 10 to 12 | Every process row (10); IT-1 to IT-8 (11) |
| Information and communication | 13 to 15 | The report testing behind each IT-dependent manual row (13); EL-2 and EL-8 (14); EL-9 and FC-9 (15) |
| Monitoring activities | 16 and 17 | EL-10 and EL-3 |
From a row to a testable description
To become your control, a library row needs your roles, your report, your number and your evidence, and it has to describe what actually happens, not what policy says should. A hypothetical example: Tarnwell Instruments, a maker of test equipment with four plants, adapts row IN-7.
Before, as it stood in Tarnwell’s matrix: “Management reviews the inventory reserve quarterly.”
After: “By business day 6 after quarter-end, the cost accounting manager calculates the excess and obsolete reserve from ERP report INV-310 (quantity, cost and twelve-month usage by part, all four plants) using the rates in policy FIN-12. The controller, who does not prepare it, investigates every product line whose reserve moved more than $75,000 or 10 percent from the prior quarter, corroborates explanations with the plant materials managers and records questions, answers and adjustments in the review log before the entry posts.”
The rewrite added six things a tester can use: a named preparer and an independent reviewer (segregation), a deadline (timeliness), the report and its scope (its completeness and accuracy can be tested), a threshold by product line (precision), what happens to items over it (reperformance) and a review log (evidence readable without asking the reviewer). The same six turn any row into a description, and the RCM template has the columns to hold it.
Questions readers ask
Is there an official list of SOX controls?
No. Section 404 of the Sarbanes-Oxley Act has management assess internal control over financial reporting each year and, for accelerated and large accelerated filers that are not emerging growth companies, the auditor attest to it. Neither the statute, the SEC’s rules nor AS 2201 lists the controls to have; management derives them from its own risk assessment.
What are examples of SOX key controls?
Common ones: system-enforced approval of manual journal entries (FC-1), reconciliations with independent review (FC-3), the three-way match (PP-3), call-back on vendor bank changes (PP-1), the period-end revenue cut-off test (RV-6), dual release of payments (TR-2) and the quarterly user access review (IT-3). Whether each is key for you depends on the risk it answers.
How many key controls should a company have?
There is no right number, and comparing counts with peers misleads. The count falls out of scoping: for each significant account, the controls that cover what could go wrong under each relevant assertion, without duplicates. The 90 rows here are the size of this library, not a target.
Which assertions does each control have to cover?
None in isolation. AS 2201 paragraph .28 has the auditor identify the relevant assertions for each significant account (those with a reasonable possibility of containing a material misstatement), and paragraph .40 notes that one control can address several assertions and that not every control related to an assertion has to be tested. What matters is coverage: a key control for each thing that could go wrong under each relevant assertion.
Are IT general controls key controls?
They are tested like key controls but address no assertion. The SEC’s 2007 guidance says management needs to evaluate only the IT general controls necessary for other controls to work, so a system that no key control, report or automated check relies on is out of scope.
How many items are tested for each control?
By convention the number follows frequency: one for an annual control, two to four for a quarterly one, 25 to 60 for one that runs many times a day, and one test per configuration for an automated control. No PCAOB standard sets these numbers. Agree them with the external auditor first if you want the work relied on, and plan the roll-forward for controls tested at interim.
This guide is general and educational; it is not legal, accounting or securities advice.
Related guides
- SOX Compliance hub — every SOX and ITGC guide on the site, by stage of the SOX year.
- Key vs Non-Key Controls — how to choose the control that carries each risk.
- SOX Scoping and Risk Assessment — where the risks this list is checked against come from.
- How to Write a Control Description — the five parts, ten rewrites and a testability check.
- Risk and Control Matrix (RCM) Template — the 16 columns a control row lives in.
- Evaluating Control Deficiencies — what to do when one of these controls fails.
- Remediating a SOX Deficiency Before Year-End — timing, retest samples and evidence.
- SOX Compliance Checklist — the annual cycle these controls are tested in.
- AI in SOX Compliance — how to classify and test a control an AI tool performs.
Leave a Reply