A SOX deficiency found during the year counts at year-end only if the control is still deficient on the assessment date. Management’s assessment of internal control over financial reporting (ICFR) and the external auditor’s opinion are both made as of the last day of the fiscal year, so a control that failed in May can still support an effective conclusion at year-end if three things are true: the fix was in place by that date, the fixed control has operated long enough to be tested, and an independent retest of those operations has passed.
No SEC rule and no PCAOB standard says how long that is, how many times the control must run or how many items a retest needs. The figures in use (two operations of a quarterly control, three of a monthly one, a full quarter of a daily one, or less) are practice: each company’s own program policy and what its audit team asks for. That is why the policy that will apply to you should be agreed with the external auditor in writing early in the year, before the first deficiency turns up.
This guide is the arithmetic and the evidence: what the texts say and whom they bind, the range of operating periods and retest samples in use, the latest go-live dates for a 31 December year-end, and what happens when the calendar runs out. It assumes the deficiency has been classified by the method in evaluating control deficiencies, and it is one of the testing-season guides on the SOX compliance hub.
In this guide
- The as-of date: what the rules say, and whom they bind
- How long the fixed control must operate, and how much to retest
- Latest go-live dates for a 31 December year-end
- What a complete remediation consists of
- When there is not enough time
- Material weaknesses: what is disclosed, filing by filing
- Worked example: three deficiencies at Dunmere Industrial Supply
- What to tell the external auditor and the audit committee, and when
- Common mistakes
- Questions readers ask
- Related guides
The as-of date: what the rules say, and whom they bind
Two sets of text apply, and they bind different parties. SEC rules bind the company and its management: Exchange Act Rule 13a-15(c) has management evaluate ICFR as of the end of each fiscal year, and Regulation S-K Item 308(a)(3) puts the conclusion in the annual report, requires disclosure of any material weakness management identified, and bars an effective conclusion while one exists. PCAOB Auditing Standard 2201 binds the external auditor of a company that needs an attestation (which companies do is in SOX 404(a) vs 404(b)). Neither has a section on remediation. What they say is spread over a handful of paragraphs (cited here as in force in November 2026), and none of them contains a minimum period, a number of operations or a sample size.
| Text | Binds | What it says | A number? |
|---|---|---|---|
| Rule 13a-15(c); Regulation S-K Item 308(a)(3) | Management | ICFR is evaluated, and the conclusion stated, as of fiscal year-end; a material weakness at that date rules out an effective conclusion | A date, no period |
| SEC interpretive guidance, Release 33-8810 (2007), footnote 20 | Management, as guidance | If every material weakness found during the evaluation is remediated by year-end, management may conclude ICFR is effective; it should still consider whether disclosing the remediated weakness is appropriate or required under Items 307 or 308 | None |
| Release 33-8810, section II.A.2.b | Management, as guidance | The evaluation ordinarily considers evidence from a “reasonable period of time during the year, including the fiscal year-end” | None |
| AS 2201 paragraphs .B1 and .B2 | External auditor | The opinion is as of a point in time; the auditor needs evidence that ICFR operated effectively for “a sufficient period of time”, which may be less than the full year | None |
| AS 2201 paragraph .53 | External auditor | Where management changed a control before the as-of date, including to address a deficiency, and the new control meets the control objectives and has been in effect for a period sufficient to test its design and operation, the superseded control need not be tested for the ICFR opinion | None |
| AS 2201 paragraph .52 and the note to .26 | External auditor | Testing over a longer period gives more evidence than testing over a shorter one, and testing closer to the as-of date more than testing earlier; the auditor balances the two. The annual close normally happens after that date, so its controls usually cannot be tested until then | None |
| AS 2201 paragraph .27 (note) | External auditor | The auditor needs sufficient evidence of the effectiveness of the quarterly controls that matter to the conclusion as of the assessment date, and is not required to obtain it for each quarter individually | None |
| AS 2201 paragraphs .B4 and .B6 | External auditor | In the financial statement audit, relying on a control takes evidence that it operated effectively through the whole period of reliance; the auditor determines what effect, if any, a deficiency has on the substantive procedures | None |
| AS 2201 paragraph .62 | External auditor | The severity of each deficiency is judged as of the date of management’s assessment | A date, no period |
The SEC release is guidance, not a rule: Rule 13a-15(c) says an evaluation carried out in line with it satisfies the rule, and acknowledges there are other ways. Three consequences follow from the table.
- The conclusion is about a date; the evidence is about a period. For a control that recurs, one clean operation on 30 December shows the design and one performance. On its own it is thin evidence that the control operates.
- Bad news needs less evidence than good news. A note to AS 2201 paragraph .47 says that, generally, a conclusion that a control is not operating effectively can rest on less evidence than a conclusion that it is. One failed retest item can settle the matter; a pass needs the whole sample.
- Remediation fixes the year-end conclusion and nothing earlier. The quarters in which the control was down have already been certified by the officers, the auditor cannot rely on the control for those months, and somebody still has to show that the numbers produced while it was down were right.
How long the fixed control must operate, and how much to retest
Because the texts stop at sufficient and reasonable, every program writes its own policy, and the policies differ. The table sets the three positions you will meet side by side: the least some programs accept (the rule of thumb in SOX for control owners sits here), the common program policy (the written rule in the worked example of the deficiency evaluation guide, and the cycle counts in evidence standards for issue closure), and what external auditors commonly ask for, in practice, when they will reach their own conclusion on the control. Every column is practice. None is a requirement of the SEC or the PCAOB, and none is taken from an audit firm’s methodology.
| Control frequency | Least some programs accept | Common program policy | What external auditors commonly ask for | Retest sample (practice) |
|---|---|---|---|---|
| Many times a day, or event-driven | Enough post-fix items for a sample of 25 | At least a month; often a full quarter | Their own sample of post-fix items running to year-end; the conventional sizes are 25 to 60 | 25; 40 to 60 at higher risk; every item if fewer than 25 exist |
| Daily | A few weeks | A full quarter | Their own sample; at the conventional 25 to 40 items that is five to eight weeks of operation | 20 to 25; 30 to 40 at higher risk |
| Weekly | Five operations (a figure derived here from the conventional minimum weekly sample of 5, not one taken from a program) | A full quarter (about 13 operations) | Their own sample; at the conventional 5 to 15 items that is five to fifteen weeks, the last in December | 5; 10 to 15 at higher risk |
| Monthly | Two operations | Three operations | Two or three operations, the year-end month among them | Every post-fix operation |
| Quarterly | One operation, with design evidence and corroboration | Two operations | Two operations; one alone is seldom accepted for a control that failed | Every post-fix operation |
| Annual or year-end only | One operation | One operation, with design evaluation and corroboration | The same, tested after it has run | The one instance |
| Automated (configured) | In production with one tested instance | The same, with change and access controls effective from the change date to year-end | Their own test of the configuration, the change record and the IT general controls behind it | One per configuration |
Read the table as a range to settle in advance, not a menu to choose from in November. The first column is the weakest position, and in practice many auditors will not accept it for a control that has already failed. One figure in it is arithmetic, not observation: the weekly floor of five operations is derived from the conventional minimum weekly sample of 5.
Where the company has an auditor’s attestation, or wants the auditor to use management’s retest, the auditor’s expectation governs. It comes from the audit firm’s own methodology, not from AS 2201, so the only way to learn it is to ask; the auditor column records what SOX teams are commonly told, not any firm’s manual. Where no auditor attests, management sets the policy, and the SEC’s guidance says the evaluation would ordinarily consider evidence from a reasonable period that includes year-end.
So ask early. At the planning meeting in the first quarter, put the remediation policy in the scoping memo or a short letter and have the engagement team confirm it: operations required by frequency, retest sample, whether the year-end operation must be included, whether extra off-cycle operations count, and who may perform the retest. A policy agreed in March is applied in November. One first raised in November is negotiated against a deadline. The sample figures follow the conventions in audit sample sizes demystified and testing controls in small populations, where their origin is explained; in practice a control that failed this year is seldom treated as lower risk, so plan on the higher figure.
Retest conventions that rarely vary
- Post-fix operations only. The go-live date is documented and the population starts after it. Operations before and after the fix are two populations and are never mixed in one sample, and a failed interim result is not carried forward by roll-forward procedures: the retest is a fresh test.
- The failed attribute is tested by name. If the reconciliation failed on aged items, the retest attribute is the treatment of aged items, not the presence of a signature.
- A design change gets a fresh walkthrough first. AS 2201 paragraphs .42 and .43 have the auditor test design by a mix of inquiry, observation and inspection, for which a walkthrough that includes them is ordinarily sufficient; walkthrough vs test of controls explains the division of labor.
- The tester did not design the fix. Under AS 2201 paragraphs .16 to .19 the auditor’s use of anyone else’s work turns on that person’s competence and objectivity and on the risk of the control, the subject of getting external audit to rely on your testing.
- The population is proved complete. For an event-driven control, the listing of post-fix events is information produced by the entity and gets its own check, as set out in IPE testing.
- A close control’s year-end operation is in the sample. It is the operation over the balance the conclusion is about.
- A failed retest restarts the count. With two or three operations there is no larger sample to extend into, so an exception means the fix did not work: find the cause, correct it and start again. In larger samples, apply the method in handling audit test exceptions.
Latest go-live dates for a 31 December year-end
Counting back from the assessment date turns the policy into dates. The table uses the 2026 calendar, in which 31 December is a Thursday; business days exclude weekends, Thanksgiving (26 November), Christmas Day and New Year’s Day. A close control’s operation counts by the period-end it covers, so the December reconciliation prepared in January is a year-end operation.
| Control | Common program policy | Latest go-live | Least some programs accept | Latest go-live |
|---|---|---|---|---|
| Many times a day, or event-driven | At least a month, often a full quarter | Tuesday 1 December for a month (22 business days); Thursday 1 October for a quarter | Enough post-fix items for a sample of 25 | No fixed date: early enough for 25 post-fix items to exist by 31 December |
| Daily | A full quarter: 64 business days | Thursday 1 October | A few weeks, counted here as 20 to 25 operations (the conventional minimum daily sample) | Thursday 3 December for 20; Wednesday 25 November for 25 |
| Weekly | 13 operations, weeks beginning 5 October to 28 December | Monday 5 October | 5 operations (the derived floor), weeks beginning 30 November to 28 December | Monday 30 November |
| Monthly, performed during the month | October, November and December operations | Before the October operation | November and December operations | Before the November operation |
| Monthly close control | October, November and December month-ends | Before the October close opens on Monday 2 November | November and December month-ends | Before the November close opens on Tuesday 1 December |
| Quarterly, performed during the quarter | Third- and fourth-quarter operations | Before the third-quarter operation | Fourth-quarter operation alone | Before the fourth-quarter operation |
| Quarterly close control | Third-quarter and year-end closes | Before the third-quarter close opens on Thursday 1 October | Year-end close alone | Before the year-end close opens on Monday 4 January 2027 |
| Annual or year-end only | Its one operation | Before it is performed | The same | The same |
| Automated | Change in production and tested; IT general controls effective to year-end | By 31 December; mid-December in practice, to leave time for the test | The same | The same |
For a calendar-year company in mid-November 2026, the common-policy column has closed for everything except annual, year-end, automated and high-volume transaction controls. The lower bar is still open for a daily control fixed by 25 November, a weekly control fixed by 30 November (on the derived floor of five), a monthly close control fixed before the November close opens and a quarterly control fixed before its fourth-quarter operation. Where the auditor attests or will use the retest, whether the lower bar is enough is the auditor’s decision, so the question goes to them this week, not in January. Holiday weeks cost operations: a weekly control performed on Fridays has none on 25 December 2026.
For any other year-end the pattern is the same. Under the common policy a daily or weekly fix has to be live at the start of the last quarter, a monthly close control before the close of the tenth month opens, and a quarterly close control before the third-quarter close opens. Everything later is the lower bar or next year.
Three levers recover time. Each is practice, and each needs the auditor’s agreement before it is used. Go live control by control, so that each count starts at that control’s first complete operation and not at the end of the project. Run the control more often for a period (a quarterly review performed monthly from October, or one extra operation at the November close), provided every run is the full control on real data and the higher frequency is written into the control description. Or automate the step: by convention a configured control needs one tested instance after the change plus effective change and access controls from the change date to year-end, the logic in testing automated controls. A fixed IT general control restores reliance on the reports and automated controls behind it only from the fix date; the earlier months are evaluated through the applications that depend on it.
What a complete remediation consists of
Remediated is a conclusion with six parts behind it. Programs that lose the argument in January usually have the first three and a promise about the rest.
| Part | What it has to show | Evidence | How it goes wrong |
|---|---|---|---|
| 1. Cause | Why the control failed, specifically enough to design against | Cause analysis agreed with the control owner, tied to the attribute that failed | Recorded as human error or lack of documentation |
| 2. Design change | The redesigned control would prevent or detect the misstatement at the precision needed | Revised control description and matrix row; the tester’s design walkthrough | Documentation improved when the failure was design or precision |
| 3. Implementation | The change is live from a known date and owned by the person who will run it | Approved procedure; change ticket with before and after configuration; hand-over; go-live date | No dated go-live; the project team still performs the control |
| 4. Operation | The control ran as designed, on its own calendar, after go-live | Each operation’s output with reviewer evidence, exceptions and follow-up; a complete listing for event-driven controls | Operations under a half-finished design counted |
| 5. Retest | An independent tester’s sample of post-fix operations passed, the failed attribute included | Test workpaper: population, sample, attributes, results, tester | Pre-fix and post-fix items mixed; the designer tests the fix |
| 6. Re-evaluation | The classification as of year-end, stated with dates, and an answer for the period the control was down | Updated deficiency memo: go-live date, operations, retest result, year-end status; lookback results | Remediated recorded from the design-approval date; no lookback |
The cause comes first because the retest is designed from it; the technique is in root cause analysis for audit findings. Part 6 carries the lookback: substantive work over the population processed while the control was down, which is separate from the control retest and is what answers the question about the earlier quarters. Management owns all six parts. COSO Principle 17 expects deficiencies to be evaluated and communicated in a timely manner to the people responsible for corrective action, and to senior management and the board as appropriate (explained in COSO’s 17 principles); in SOX terms that is the deficiency log, the plan below and the audit committee update. The mechanics of running several fixes at once (owners, weekly rhythm, evidence binder) are in remediating audit findings: the 90-day plan, and the evidence levels a validator applies are in evidence standards for issue closure.
Part 2 depends on what kind of failure it was, and so does the point from which operations count.
- Not performed, or performed late. Fix the cause (backup performer, close calendar, workload). The design stands, so no new walkthrough is needed unless the procedure changed. Count from the first on-time operation after the corrective step.
- Performed but not evidenced. Set the evidence standard. Past operations cannot be evidenced after the fact, so count from the first operation that left the evidence.
- Wrong design or precision. Redesign, walk through again, and count only operations of the complete new design. This is the usual case for management review controls, where a documentation project fixes an evidence gap and nothing else.
- Wrong or unproven information. Correct the report through change management and prove its completeness and accuracy. Where practical, re-perform the control on corrected information for the affected periods, which also serves as the lookback.
The remediation plan template
One page per deficiency. The example column is the reconciliation deficiency from the worked example below.
| Field | What to write | Example |
|---|---|---|
| Deficiency and control | IDs, control name, frequency, key or not, owner by name | R1; goods received not invoiced (GRNI) accrual reconciliation; monthly; key; accounts payable manager |
| What failed, and since when | The attribute that failed and the period of the deficiency | Aged reconciling items carried forward uninvestigated; review left no trace; January to August |
| Classification today | As evaluated at the last quarter-end, with the memo reference | Control deficiency (third-quarter memo) |
| Cause | One sentence the fix answers | Procedure had no aging rule; reviewer had no criteria |
| Design change | Who does what, when, to what threshold, leaving what evidence | Items over 60 days need a documented disposition; five-point review checklist; assistant controller reviews by business day 6 |
| Go-live | The first period the new design applies to | September month-end (reviewed 8 October) |
| Operations by year-end against the agreed policy | Counted by date | Four (September to December month-ends) against a policy of three |
| Interim cover and lookback | What limits the risk until go-live; what was checked for the period the control was down | 61 aged items cleared; $37,000 written off with approval |
| Retest | Tester, dates, population, sample, attributes including the failed one | Internal audit senior with no part in the design; every post-fix operation; aging, disposition, review evidence, timeliness |
| Dependencies and drop-dead date | What must arrive and from whom; the date after which the policy cannot be met | None; 2 November, when the October close opens |
| Auditor agreement | Date, and what was confirmed in writing | 28 August: three operations, year-end month included, retest usable subject to their own re-performance |
| Reporting | Where status goes, and when | SOX steering committee monthly; audit committee 27 October and 16 February |
When there is not enough time
A control that cannot meet the agreed policy by year-end is evaluated as a deficiency at year-end, however good the fix. That is how the as-of date is meant to work.
| Situation | Status at the as-of date | What to do |
|---|---|---|
| Fix is live but has fewer operations than the agreed policy | Cannot be concluded effective; the deficiency stands | Evaluate severity as it stood; record the go-live date; schedule the remaining operations and the retest in the new year |
| Fix is not live | Deficient for the whole period | Evaluate severity; identify any compensating control that already operated and test it for the whole period; keep an interim control running until go-live |
| The year-end operation of the fixed control fails | Deficient; no further operation exists | Treat the fix as failed; evaluate; correct the cause before the first-quarter operation |
| A recurring control is found deficient in December, or any control fails in year-end testing | Usually too few operations remain to meet the agreed policy | Evaluate; remediate for next year; consider what the lookback says about the year-end numbers |
| Fix completed after year-end, before the Form 10-K is filed | Still deficient at the as-of date | Evaluate as at year-end; if it is a material weakness, describe the corrective action in the filing, knowing the auditor will disclaim an opinion on that description (AS 2201 paragraph .96) |
The evaluation itself follows the deficiency evaluation guide: likelihood and magnitude over the whole period the control was down, then compensating controls, then aggregation with other deficiencies in the same account or process. A compensating control changes the severity, not the existence, of the deficiency, and only if it operates at a precision that would prevent or detect a misstatement that could be material (AS 2201 paragraph .68 for the auditor; the SEC’s guidance says the same to management). In practice it must also have been tested for the whole period of the deficiency: an interim control started in October does nothing for January to September.
What is reported depends on the classification at the as-of date. A control deficiency goes to management. A significant deficiency goes to the audit committee and the external auditor and need not be disclosed publicly: the officers’ certification under Regulation S-K Item 601(b)(31) has them confirm that all significant deficiencies and material weaknesses have been disclosed to both, and AS 2201 paragraph .80 has the auditor communicate significant deficiencies to the audit committee in writing. A material weakness is disclosed in management’s report and, where the auditor attests, produces an adverse opinion on ICFR under AS 2201 paragraph .90.
Material weaknesses: what is disclosed, filing by filing
A material weakness that exists at year-end must be disclosed in management’s annual report under Item 308(a)(3), which sits in Item 9A of Form 10-K. The SEC’s 2007 guidance adds that management should consider describing the nature of the weakness, its impact on financial reporting and ICFR, and its current plans or actions already taken to remediate it, and that the conclusion cannot be qualified: ICFR is effective or it is not. Two quarterly disclosures run alongside. Item 307 requires the officers’ conclusion on disclosure controls and procedures as of each period-end, and Item 308(c) requires disclosure of any change in ICFR during the last fiscal quarter (the fourth quarter, in the annual report) that “has materially affected, or is reasonably likely to materially affect” it. Form 10-Q carries both in Part I, Item 4.
SEC staff read Item 308(c) as covering material improvements as well as other changes, whether or not they respond to a material weakness (the staff FAQ on management’s report, revised 24 September 2007, question 7). Remediating a material weakness therefore usually produces a change disclosure in the quarter the new controls go in. Whether the fix for a lesser deficiency is a material change is a judgment for the disclosure committee, and in practice the answer for a single redesigned control is often no; minute the reasoning either way. That quarterly judgment is worked through in SOX 302 sub-certifications, and the certification mechanics are in SOX 302 vs 404 vs 906.
| Filing | What the rules and SEC guidance say | How remediation usually reads (practice) |
|---|---|---|
| Form 10-K for a year in which the weakness exists at year-end | Item 308(a)(3): disclose the weakness; no effective conclusion. Item 307 conclusion. Where attested, an adverse ICFR opinion (AS 2201 paragraph .90) | The plan in the future tense, with a statement that the weakness will not be considered remediated until the new controls have operated for a sufficient period and been tested |
| Each later Form 10-Q | Item 307 conclusion as of quarter-end; Item 308(c) changes during the quarter | Disclosure controls still not effective; steps completed listed as changes; the same not-yet-remediated statement |
| The filing that reports remediation | In a 10-K: management’s conclusion as of year-end, the fourth-quarter changes and, where attested, the auditor’s opinion as of the same date. In a 10-Q: the Item 307 conclusion and the Item 308(c) change | Past tense: controls designed, implemented, operated and tested; weakness remediated as of the date. In a 10-Q this is management’s statement alone |
| Weakness found and fixed within one fiscal year | No weakness to report in the annual assessment if it is remediated by year-end; consider whether disclosure is appropriate or required under Items 307 or 308 (Release 33-8810, footnote 20) | Usually disclosed in the Form 10-Q for the quarter in which it is found and reported as remediated, with the change, in the quarter of the fix; where both fall in one quarter, often described once |
Remediation disclosures are rare next to continuing ones. In the Q3 2026 edition of the Material Weakness Tracker, which covers Form 10-K and 10-Q filings made from 1 July to 30 September 2026, 904 companies reported a material weakness: 765 (85%) were reporting one already disclosed in an earlier filing and 129 (14%) a newly disclosed one, with timing unclear for the other 10. In the same filings, 29 companies reported that a previously disclosed weakness had been remediated, with none remaining. Only 14 of the 904 concluded that their disclosure controls were effective in their latest filing reporting the weakness, so expect the Item 307 conclusion to stay at not effective until the weakness is closed.
The auditor’s interim report under AS 6115
Between annual reports, a company can ask its auditor to report on whether a material weakness described in an earlier auditor’s report on ICFR still exists. PCAOB AS 6115 governs the engagement and states that it is voluntary. Management chooses a date after its most recent annual assessment, asserts in a written report that the weakness no longer exists as of that date, and supports the assertion with evidence, using the same control framework as the annual assessment. The auditor then gives an opinion on that weakness only, not on ICFR overall. The standard sets no minimum period either: tests must cover “a period of time that is adequate”, with timing that varies with the risk of the control. Its illustration is a comparison, not a number (a transaction-based daily reconciliation can generally be evidenced in a shorter period than a pervasive company-level control), and controls over the period-end close can typically be tested only in connection with a period-end. A pervasive weakness, such as one in the control environment, is probably not suitable for the engagement. In practice few companies commission one; the usual course is to wait for the next annual audit.
Two pending SEC proposals
Two SEC proposals bear on this guide. Both were proposed, not final, as of November 2026. One, Release 33-11414 (proposed 5 May 2026), would let a company elect to file semiannual reports on a new Form 10-S in place of quarterly reports on Form 10-Q, the form that carries the quarterly change disclosure. The other, Release 33-11419 (proposed 19 May 2026), would eliminate the accelerated filer category and require the auditor’s attestation only from large accelerated filers. This guide describes the rules in force; work to them, and re-check both proposals before relying on either.
Worked example: three deficiencies at Dunmere Industrial Supply
Dunmere Industrial Supply is a hypothetical US-listed distributor with a 31 December year-end; it is an accelerated filer whose auditor attests to ICFR. The figures are illustrative. In March 2026 the SOX team and the engagement team agreed the program’s remediation policy in writing: three operations for a monthly control, two for a quarterly control, the year-end operation among them, extra operations counted only if agreed beforehand, retests by internal audit staff with no part in the design. Interim testing of January to June operations was reported on Friday 21 August 2026, with 132 days left in the year, and logged three deficiencies.
| Deficiency | Found at interim | Cause and fix | Operations after go-live | Year-end result |
|---|---|---|---|---|
| R1: monthly GRNI accrual reconciliation | Reconciling items older than 90 days carried forward uninvestigated in five of six months; review evidenced by signature only | No aging rule, no review criteria. New standard issued 15 September: disposition for items over 60 days, five-point review checklist | Four: September, October, November and December month-ends | Remediated as of 31 December |
| R2: quarterly ERP user access review | Reviewer listing omitted 46 accounts in two role groups; 5 of 31 removals requested in the second quarter still active | Saved query filtered on employee type; no check that removals happened. Listing rebuilt with a count tie-out to the system; removals confirmed within five business days | Two: third-quarter review, and a fourth-quarter review moved forward to finish on 11 December | Remediated as of 31 December |
| R3: quarterly excess and obsolete inventory reserve review, a management review control | Sign-off only; no stated threshold; aging report never checked; $0.9 million of management overlays unchallenged | Precision undefined. Redesign: thresholds by product category, checks on a new aging report, documented challenge. The report needed an ERP change | One: the year-end review on 15 January 2027. The report reached production on 21 December | Not remediated; significant deficiency at 31 December |
| Date | What happened |
|---|---|
| Fri 21 Aug 2026 | Interim results to the SOX steering committee; R1, R2 and R3 logged; engagement partner told the same day |
| Fri 28 Aug | Causes agreed and plans approved by the controller; the auditor confirms the March policy applies, agrees that R2’s fourth-quarter review may run in early December, and says it will re-perform a selection of management’s retests |
| Fri 11 to Fri 18 Sep | R2 procedure approved (11th); R1 standard issued (15th); R3 design approved and the report change raised for the October release (18th) |
| Thu 8 Oct | R1 first operation: September reconciliation reviewed on business day 6. The October, November and December operations follow on 9 November, 8 December and 11 January |
| Thu 15 Oct | R3 third-quarter review performed with the new thresholds on the old report. The SOX team rules that it is not an operation of the redesigned control. The October release slips and the plan is not redrawn |
| Fri 23 Oct | R2 third-quarter review completed on the full listing as of 30 September; removals confirmed 30 October |
| Tue 27 Oct | Audit committee: R3 reported as a significant deficiency, and to the auditor in writing, before the third-quarter certifications are signed; R1 and R2 reported as control deficiencies with plans |
| Fri 11 Dec | R2 fourth-quarter review completed on the listing as of 30 November; removals confirmed 18 December |
| Mon 14 to Wed 23 Dec | Retests: R1 (September to November operations) on 14 to 18 December; R2 (both operations) on 21 to 23 December. Both pass. R3’s report goes live on the 21st |
| Mon 11 to Thu 21 Jan 2027 | R1 December operation (11th) retested and passed. R3 year-end review (15th) tested 19 to 21 January: operated as designed, one operation against a policy of two |
| Fri 29 Jan | Evaluation meeting: R1 and R2 remediated as of 31 December; R3 evaluated as it stood |
| Tue 16 Feb | Audit committee: final classifications; the significant deficiency communicated in writing by management and by the auditor |
| Thu 15 Apr | R3 second operation (first-quarter review); retested, and reported as remediated to the audit committee on 4 May |
R3 was evaluated as a design deficiency that ran for three quarters over a judgmental estimate. Management put the reasonably possible misstatement at $1.6 million against overall materiality of $3.0 million, and identified one compensating control that had operated all year: FP&A’s independent quarterly recalculation of the reserve from the perpetual inventory records, with differences above $250,000 investigated, tested for all four quarters. The conclusion was a significant deficiency and not a material weakness; ICFR was concluded effective and the auditor concurred. The disclosure committee judged that none of the three redesigns was a change that materially affected ICFR and minuted why.
The lookbacks were separate work. For R1, 61 aged items were investigated and cleared, with $37,000 written off. For R2, system logs for the 46 unreviewed accounts and the 5 unprocessed removals showed no postings outside each account’s intended use from January to September.
The three outcomes were decided by dates, not effort. R1 had slack because the fix was live for the first close after the finding. R2 met the policy because the calendar was moved and the auditor had agreed the move. R3 was lost in October: when the release slipped, an extra operation at the November close was still possible if the report arrived by 1 December and the auditor agreed, and nobody asked.
What to tell the external auditor and the audit committee, and when
The auditor decides what it will accept, and the audit committee hears about anything significant from both sides, so neither should learn the year-end position at year-end. The cadence below fits the quarterly pack described in reporting to the audit committee and the season calendar in the SOX compliance checklist.
| When | External auditor | Audit committee | Basis |
|---|---|---|---|
| Within days of the finding | The failed attribute and the period; ask what operations and sample a retest will need | Nothing yet, unless it may be significant or material | Practice |
| Before each Form 10-Q or 10-K is signed | Every significant deficiency and material weakness; put it in writing | The same, before the officers certify | Certification paragraph 5 (Item 601(b)(31)) for the disclosure, practice for the writing; AS 4105 paragraph .33 gives the auditor its own duty to tell the committee |
| When the plan is approved | Go-live date, operations expected by year-end against the agreed policy, who will retest | Plan, dates and drop-dead date for anything significant | Practice |
| At go-live and after each operation | Evidence ready for their walkthrough and tests | Operations completed out of those required | Practice |
| The day a date slips past the drop-dead date | The control will not meet the policy; the expected year-end classification | The same at the next meeting, not at year-end | Practice |
| Year-end evaluation | Representation letter: all deficiencies disclosed; earlier ones resolved or not; changes and corrective actions since the as-of date | Final classifications; the auditor’s written communications | AS 2201 paragraphs .75, .78, .80 and .81 |
| After year-end, before the report | Corrective actions taken since the as-of date | What was fixed after year-end and how it will be described | AS 2201 paragraphs .93 and .96 |
For each remediated control the auditor will want four things: dated evidence of go-live, the full list of post-fix operations, management’s retest workpapers if they are to be used, and enough days before sign-off to walk through the new design and test it. Status wording matters most in the fourth quarter, as two pairs show.
- Don’t say: “Remediation of R3 is substantially complete.” Say: “R3 will have one of the two operations our policy requires. It will be evaluated as a deficiency at 31 December and we expect a significant deficiency. The second operation is in April and the retest follows.”
- Don’t say: “R2 was remediated in September.” Say: “R2’s redesign went live in September. It has operated once; the second operation finishes on 11 December and the retest on 23 December.”
Common mistakes
- Dating remediation from the design change. The count starts at the first operation of the complete control.
- Fixing the paperwork when the design failed. Better documentation remediates an evidence deficiency. It does not give a review a threshold it never had.
- Counting operations of a half-built control. A review run with the new thresholds on the old report is the old control with new headings.
- Sampling across the fix date. Pre-fix passes say nothing about the fix; pre-fix failures are already known.
- Skipping the lookback. The retest answers whether the control works now. It does not answer whether the numbers were right while it did not.
- Leaving the auditor out until December. Their operations count and sample are facts about the plan, and they are cheapest to learn in August.
- Announcing remediated before the year-end operation. For a close control the most important operation happens in January.
- Letting a slipped dependency sit. A report or system change that misses its release needs a new plan that week, including whether an extra operation is still possible.
- Closing the item for good. A fix that passed in December can decay by June; next year’s interim test and sustainability testing are where that shows.
This guide is general and educational; it is not legal, accounting or securities advice.
Questions readers ask
How long does a remediated SOX control have to operate before year-end?
No SEC rule or PCAOB standard gives a number: AS 2201 asks for a sufficient period and the SEC’s guidance for a reasonable one. A common program policy is two operations of a quarterly control, three of a monthly control and a full quarter of a daily or weekly control; some programs accept one, two and a few weeks. All of that is practice. Where the external auditor reaches its own conclusion on the control, its expectation governs, so agree the policy in writing early in the year.
What sample size is used to retest a remediated control?
The same as the original test, but drawn only from operations after the fix: every post-fix operation of a quarterly or monthly control, 5 to 15 of a weekly control, 20 to 40 of a daily control and 25 to 60 of a control that runs many times a day. These are conventions, not requirements. The sample includes the attribute that failed, and the tester is not the person who designed the fix.
Can a control fixed in December be counted as effective at year-end?
Sometimes. An annual or year-end close control has only one operation, and by convention an automated control needs one tested instance with effective IT general controls. A daily control fixed on 1 December 2026 would have 22 operations by year-end, which meets only the lowest bar in use. A monthly or quarterly control fixed in December usually has one operation by year-end, which the common policy treats as design evidence and one data point.
If a material weakness is remediated before year-end, does it still have to be disclosed?
Management may conclude that ICFR is effective at year-end if every material weakness has been remediated by then; the SEC’s 2007 guidance says so in a footnote. The same footnote tells management to consider whether disclosing the remediated weakness is appropriate or required under Items 307 or 308, and a material change made to fix it falls under Item 308(c) for the quarter in which it was made.
Does the auditor have to test the old control once it has been replaced?
Not for the opinion on ICFR, if the new control has been in effect for a period sufficient to test its design and operation (AS 2201 paragraph .53). For the financial statement audit, the same paragraph has the auditor test the superseded control where its operation matters to control risk. A control that failed gives no such reliance, so the months before the fix usually get more substantive testing.
What happens if the retest finds an exception?
With two or three post-fix operations there is nothing to extend the sample into, so the fix is treated as failed, the cause is corrected and the count starts again. In a larger sample the usual exception handling applies: an isolated, explained deviation may support extending the sample; a systematic one does not.
Can the auditor report during the year that a material weakness no longer exists?
Yes, under PCAOB AS 6115, which is a voluntary engagement. Management asserts in writing that the weakness no longer exists as of a date after its last annual assessment, and the auditor gives an opinion on that weakness only, not on ICFR as a whole.
Is a significant deficiency disclosed publicly?
It does not have to be. It is reported to the audit committee and the external auditor, and the SEC’s 2007 guidance notes that significant deficiencies are not required to be disclosed in management’s annual report. The officers still confirm in each quarterly and annual certification that every significant deficiency has been disclosed to the auditor and the audit committee.
Related guides
- SOX Compliance hub — every SOX and ITGC guide on the site, by stage of the SOX year.
- Evaluating Control Deficiencies: From Exception to Material Weakness — the classification this guide starts from, with a memo template.
- Compensating Controls: When Plan B Is Good Enough — the six tests a compensating control has to pass.
- SOX Roll-Forward Testing — the other half of the interim-to-year-end problem.
- SOX Compliance Checklist — where remediation and retesting sit in the annual cycle.
- SOX 404(a) vs 404(b) — which companies have an auditor’s attestation to satisfy.
- Audit Sample Sizes Demystified: Where 25, 40, and 60 Come From — the conventions behind the retest samples.
- Testing Controls in Small Populations — monthly, quarterly and annual controls, and a failure in a population of two.
- Test of Design vs Operating Effectiveness — why a redesign needs both tests again.
- Management Review Controls (SOX) — precision, evidence of review and the four kinds of review-control deficiency.
- SOX for Control Owners — the owner’s side of testing, exceptions and retests.
- SOX 302 vs 404 vs 906 — the certifications and Item 308(c) in full.
- Material Weakness Tracker: Q3 2026 — who disclosed a material weakness, and who reported one remediated.
- Remediating Audit Findings: The 90-Day Plan — the program mechanics for running several fixes at once.
Leave a Reply