Internal controls, the risk-control matrix and control testing, with a SOX 404 walkthrough

Answer first. Internal control is a process, run by the board, management and staff, that gives reasonable assurance about operations, reporting and compliance objectives (COSO 2013). A risk-control matrix records which control addresses which risk. Control testing checks that each control is designed to work and operated. SOX Section 404 makes management assess and report on this for financial reporting each year.

What internal control is, and what it is not

The definition regulators and auditors use comes from COSO's Internal Control — Integrated Framework (May 2013). Internal control is a process, effected by an entity's board of directors, management and other personnel, designed to provide "reasonable assurance regarding the achievement of objectives" in three categories: operations, reporting and compliance. COSO draws five consequences: internal control is aimed at objectives; it is a process, not an end in itself; it is effected by people, not by manuals and forms; it gives reasonable, not absolute, assurance; and it can apply to a whole entity or to one unit or process.

The three categories set the scope of a control program. Operations objectives cover effectiveness, efficiency and safeguarding assets; reporting objectives cover internal and external, financial and non-financial reporting; compliance objectives cover laws and regulations. SOX Section 404 concerns one slice of one category, external financial reporting, so a control library built only for SOX misses most of what COSO expects.

COSO also lists why even an effective system can fail: unsuitable objectives, faulty human judgment, simple error, management override, collusion and external events. Those limitations are why the standard is reasonable assurance, which the SEC ties to Exchange Act Section 13(b)(7): the degree of assurance that would satisfy prudent officials in the conduct of their own affairs (SEC Release 33-8810, page 3).

Three things internal control is not:

• The policy or the procedure. A policy states what is expected and a procedure puts it into action (COSO principle 12); the control is the specific action that mitigates a risk. Policy vs Procedure vs Control draws the line.
• Internal audit. Internal audit evaluates controls (IIA Standard 2130); management owns them.
• The RCSA or the risk assessment. Those identify and rate risks; control testing verifies that a control operated, with evidence. RCSA vs Risk Assessment vs Control Testing sets the boundaries.

For the short definition, see What are internal controls?.

The five components and seventeen principles

COSO 2013 organizes internal control into five components and seventeen principles. Its test of effectiveness has two parts: each component and relevant principle must be present and functioning, and the five components must operate together. Where a major deficiency exists in either, the organization cannot conclude that its internal control is effective. SEC rules require management's annual ICFR assessment to use a suitable, recognized control framework (17 CFR 240.13a-15(c)), and COSO is the one almost every US registrant names.

The five components and seventeen principles

Component	What it covers	Principles (paraphrased)
Control environment	Tone at the top, ethical values, board oversight, structure and authority, competence, accountability	1 Commitment to integrity and ethical values; 2 Board independence and oversight; 3 Structures, reporting lines and authorities; 4 Attracting, developing and retaining competent people; 5 Holding individuals accountable
Risk assessment	Identifying and assessing risks to objectives, including fraud and change	6 Objectives specified clearly enough to identify risks; 7 Risks identified and analyzed across the entity; 8 Potential for fraud considered; 9 Significant changes identified and assessed
Control activities	Actions through policies and procedures that carry out management's directives; preventive or detective, manual or automated; segregation of duties	10 Control activities selected and developed to mitigate risks; 11 General controls over technology; 12 Deployment through policies and procedures
Information and communication	Relevant, quality information; internal and external communication	13 Relevant, quality information; 14 Internal communication of objectives and responsibilities; 15 Communication with external parties
Monitoring activities	Ongoing and separate evaluations; deficiencies evaluated and communicated	16 Ongoing and separate evaluations of whether components are present and functioning; 17 Deficiencies evaluated and communicated in a timely manner to those responsible for corrective action

Two practical uses. Map every control in the library to at least one principle; a principle with no controls is a gap. And use component 5 to shape the testing program: COSO says ongoing evaluations are built into business processes and separate evaluations vary with assessed risk, which is the root of the SEC's later distinction between ongoing monitoring and direct testing. The COSO Internal Control — Integrated Framework 2013 framework page holds the official resources.

Types of control, with examples

Controls are classified on several independent axes, and one control has a value on each. The classification decides how the control is tested, how many samples are taken and how much a failure matters.

Types of control, with examples

Axis	Type	What it does	Example	Source
Timing	Preventive	Stops an error or unauthorized transaction before it is recorded	System blocks a purchase order above the requester's approval limit; segregation of vendor set-up from payment	COSO 2013
Timing	Detective	Finds an error after it has occurred	Monthly bank reconciliation; budget-to-actual variance review; duplicate-invoice exception report	COSO 2013
Timing	Corrective	Fixes the error and its cause once detected	Correcting journal with root-cause note; re-run of a failed batch job; CAPA record	Common practice, not a COSO term; see What is a CAPA program?
Nature	Manual	Performed by a person	Controller reviews and signs the accruals schedule	COSO 2013
Nature	Automated	Performed by a system, consistently	ERP enforces the three-way match tolerance before an invoice posts	SEC 33-8810, page 16
Nature	IT-dependent manual	A person acts on a system-generated report	Manager investigates items on a computer-generated exception report	SEC 33-8810, footnote 36
Importance	Key	Alone or with a few others, addresses the risk of material misstatement for a relevant assertion	Reconciliation of the main operating bank account	SEC 33-8810, page 4
Importance	Non-key	Supports the process, but its failure alone would not leave a material misstatement undetected	Secondary review of a report a key control already reconciled	SEC 33-8810, page 4
Level	Entity-level	Pervasive across the entity	Control environment; management override; risk assessment; centralized processing and shared services; monitoring of results and of other controls (internal audit, audit committee, self-assessment); period-end financial reporting; significant business control policies	PCAOB AS 2201.24; SEC 33-8810, footnote 21
Level	Process-level	Operates inside one business process	Credit check before order release	Same
Technology	IT general control (ITGC)	Keeps automated controls and system reports reliable	Program development; program changes; computer operations; access to programs and data	ITGI/ISACA 2006; SEC 33-8810, page 20
Technology	Application control	Built into an application to enforce completeness, accuracy, validity, authorization or segregation of duties	Mandatory field validation; approval workflow; duplicate-invoice check	ITGI/ISACA 2006

The pairing that matters most for testing is automated control plus ITGC. The SEC says management only needs to evaluate the IT general controls necessary for the proper and consistent operation of other controls that address financial reporting risks (page 20). An automated control with a broken change-management ITGC cannot be relied on, however well it tested. PCAOB AS 2201 lets an auditor benchmark an automated control in later years instead of retesting it, provided ITGCs over program changes are effective (paragraphs 60 and B28 to B33).

How to write a control that can be tested

Most failed tests trace back to a control description that cannot be tested because it describes a process, or omits who does it, when, and what evidence is left. A control description should answer five questions:

1. Who performs it: a role with the required authority and competence, which PCAOB AS 2201.42 makes part of design effectiveness.
2. What they do, with the threshold. "Reviews the accruals" is not testable; "compares each accrual over $50,000 to supporting invoices or contracts and investigates differences over 5 percent" is. The SEC says a compensating control must operate at a level of precision that would prevent or detect a material misstatement (33-8810, page 37); the same standard applies to the control itself.
3. When: frequency and timing relative to the period end.
4. How, including the system and report used, so the ITGC dependency is visible.
5. What evidence the control leaves. PCAOB AS 2315.32 notes that controls which depend primarily on segregation of duties, or otherwise leave no documentary evidence, cannot be sampled; they are tested by observation and inquiry.

Write the risk first. The IIA's Implementation Guide for Standard 2130 gives the sequence: identify objectives and the risks to them, rate significance, decide the response, then identify the key controls management uses. A control with no stated risk is a task.

The risk-control matrix, column by column

A risk-control matrix (RCM) links each risk to the control that addresses it and to the test that proves it. The IIA's Implementation Guide for Standard 2130 says a risk and control matrix helps internal audit identify objectives and risks, rate their significance, ascertain the key controls, evaluate design adequacy and then test adequately designed controls for operating effectiveness. The SEC describes the same record from management's side: the controls management identifies and documents are those that adequately address financial reporting risks, and those controls are then subject to procedures to evaluate operating effectiveness (33-8810, pages 11 to 12).

The columns below support both uses. The right-hand column is a revenue-process example; the companion CSV has the same columns with three completed rows.

The risk-control matrix, column by column

Column	What it holds	Example
control_id	Stable identifier	REV-CTL-004
process, sub_process	Where the control sits	Order to cash; Credit and order release
risk_id, risk_description	What could go wrong, as "risk that ... resulting in ..."	REV-R-002: Risk that orders ship without approved credit, resulting in uncollectable receivables and overstated revenue
significant_account	Line item or disclosure affected	Accounts receivable; Revenue
assertion	Existence or occurrence, completeness, valuation or allocation, rights and obligations, presentation and disclosure (PCAOB AS 1105.11)	Valuation or allocation; Existence or occurrence
control_objective	The outcome assured	Sales are made only within approved credit limits
control_description	Who, what, when, how, evidence	The ERP blocks release of any order that would exceed the customer's credit limit; the credit manager reviews the blocked-order queue daily and approves or rejects each item in the system with a comment
control_owner	Accountable role	Credit manager
frequency	Annual to multiple times per day, or event-driven	Daily
control_type	Preventive or detective	Preventive
nature	Manual, automated or IT-dependent manual	Automated block; IT-dependent manual release
key_control, key_control_rationale	Yes or no, and why	Yes: primary control over credit risk in revenue
level	Entity-level or process-level	Process-level
itgc_dependency	System and ITGC domains relied on	ERP credit module; access; program changes
framework_mapping	COSO principle and other frameworks	COSO principle 10; SOC 2 CC6.1
test_of_design	Procedure to confirm design	Walk through one blocked order; inspect the configured limit rule; confirm the credit manager's authority in the delegation matrix
test_of_operating_effectiveness	Procedure and evidence	Sample blocked orders; inspect the system record for reviewer, decision, date and comment; re-perform the limit calculation
sample_basis, sample_size	Basis and number	OMB A-123 example for a daily control; 30
tester, test_period	Who tested, period covered	Internal audit; 1 January to 30 September, roll-forward to 31 December
result	Effective, effective with exceptions, ineffective	Effective
deficiency_id, evidence_reference	Links to deficiency and evidence records	(none); EV-2026-0412
last_tested, next_test, status	Cycle fields	2026-10-14; 2027-01-15; Tested

Two design rules. Keep every link column as a real relationship to another record so results roll up. And do not let the RCM become the control library: the library holds each control once; the RCM is that control's view against a risk, a process and a test cycle. How to Clean Up a Messy Control Library covers the difference; the glossary entry is What is a risk control matrix (RCM)?.

Scoping: the top-down, risk-based approach

The SEC and the PCAOB both require scoping to start from the financial statements and work down. The SEC's interpretive guidance rests on two principles: management should evaluate whether it has controls that adequately address the risk that a material misstatement would not be prevented or detected in a timely manner; and its evaluation of evidence about those controls should be based on its assessment of risk (33-8810, pages 4 to 5). Management need not identify every control in a process or document every business process (page 4).

1. Materiality and significant accounts. PCAOB AS 2201.28 to .33 lists the factors: size and composition, susceptibility to misstatement, volume and complexity, accounting complexity, exposure to loss, related parties and changes from the prior period.
2. Relevant assertions. For each significant account, decide which assertions have a reasonable possibility of material misstatement (AS 2201.A9). A control is key only if it addresses one.
3. Financial reporting risks. Identification ordinarily begins with how GAAP applies to the business (page 12) and must include fraud risk, which exists in any organization regardless of size (page 14).
4. Entity-level controls first. If an entity-level control adequately addresses a risk, no further evaluation of other controls for that risk is required (page 5); the SEC's example is a period-end control over interest expense (page 16).
5. Process-level controls and ITGCs. Select the controls that adequately address the remaining risks, preferring, where two both do, the one whose evidence is cheaper to obtain (page 16), and bring in only the ITGCs those controls depend on (page 20).
6. Locations. Judge the risk of each location's controls element by element rather than once per location (page 33; AS 2201.B10).

Scoping repeats every year, but the SEC expects later years to focus on changes in risks and controls rather than re-identifying everything (page 6). What is SOX scoping? has the short version.

Test of design and test of operating effectiveness

Control testing asks two questions, in order.

Test of design (TOD). Would the control, if operated as prescribed by people with the necessary authority and competence, satisfy the control objective (PCAOB AS 2201.42)? Inquiry, observation and inspection of documentation, usually through a walkthrough, are enough (AS 2201.43). A walkthrough follows a transaction from origination through the company's processes and systems to the financial records, using the documents and technology company personnel use (AS 2201.37). The IIA's guide lists the same tools for design adequacy: interviews, review of policies and processes, walk-throughs, surveys, internal control questionnaires and flowcharts.

Test of operating effectiveness (TOE). Did the control operate as designed, throughout the period, performed by someone with the necessary authority and competence (AS 2201.44)? Procedures are inquiry, observation, inspection of documentation and re-performance (AS 2201.45), and AS 2201.50 ranks them: inquiry alone is insufficient and re-performance gives the most evidence. The Implementation Guide for OMB Circular A-123 Appendix A, written for federal agencies but usable anywhere, lists the same four tests in the same order and says the same about inquiry (page 36). The IIA's guide names inspections, confirmations, continuous auditing and data analyses as effectiveness tools.

The order is not optional. A control that fails design cannot pass operation, and the IIA guide has internal audit test only controls "that have been deemed adequately designed". In a first-year program, fix design gaps before the operating-effectiveness window opens, or the year's test reports a deficiency you already knew about.

Two further distinctions. AS 2201.55 to .56 cover timing: where testing happens at an interim date, the tester decides what additional evidence covers the rest of the period. And the SEC separates direct tests of controls, performed periodically by people with a high degree of objectivity, from ongoing monitoring, meaning management's normal recurring activities such as self-assessment and performance-measure analysis (page 28). Where ICFR risk is low, ongoing monitoring may be sufficient and no direct testing is required; either way the evaluation should cover a reasonable period of the year, including the year-end (page 29). What is control testing in risk management? and What is SOX control testing? give the definitions.

The control-testing process, step by step

The control-testing process, step by step

Step	What happens	Owner	Output	Source
1 Design	Confirm the description answers who, what, when, how, evidence; perform or update the walkthrough; conclude on design; log design gaps for fixing before TOE	ICFR team with the control owner; internal audit for challenge	Walkthrough record; TOD conclusion	AS 2201.37 to .43; IIA IG 2130
2 Plan	Set nature, timing and extent from the control's risk: materiality, inherent risk, volume changes, error history, entity-level controls, frequency, reliance on other controls, competence and turnover, automation, judgment	Test lead	Test plan per control; annual calendar	AS 2201.46 to .47; 33-8810, pages 21 to 25
3 Sample	Define the population and prove it complete; choose the selection method; set the sample size on the basis below	Tester; control owner supplies the population	Population file with source and count; sample list	AS 2315.31 to .38; Population Completeness in Control Testing
4 Execute	Inquire, observe, inspect or re-perform for each item; record the result item by item; treat items that cannot be examined as deviations	Tester	Workpaper with item-level results and linked evidence	AS 2201.45 and .50; AS 2315.40
5 Evaluate	Compare deviations to the acceptable number; investigate the cause of each; decide whether the test supports reliance, needs extending, or fails; conclude for the full period including roll-forward	Tester and test lead	Effective, effective with exceptions, or ineffective	AS 2315.41; AS 2201.55 to .56; GAO FAM 450.13 to .14
6 Deficiency	Record each failed or missing control; rate severity by likelihood and magnitude, compensating controls and aggregation	ICFR lead and controller; disclosure committee and audit committee for significant items	Deficiency record with severity and rationale	AS 2201.62 to .70; 33-8810, pages 34 to 38
7 Remediate	Assign owner and date; fix design or operation; let the control operate long enough to retest; retest with a fresh sample; close only on a passed retest	Control owner; ICFR lead tracks; internal audit retests	Remediation plan; retest result; closure	33-8810, page 10; What is SOX remediation and retesting?

Control Testing Readiness Checklist lists what must exist before step 1, and How to Build a Control Testing Calendar Across SOX, SOC 2, Internal Audit, and Compliance covers step 2 across frameworks.

Sample sizes: what the published guidance says

No standard prescribes a sample size for management's SOX testing; the standards prescribe the reasoning. PCAOB AS 2201.54 says the more extensively a control is tested, the greater the evidence, and AS 2201.47 lists the risk factors that set the extent. PCAOB AS 2315.38 names the three inputs that set any sample size, statistical or not: the tolerable rate of deviation, the expected population deviation rate and the allowable risk of assessing control risk too low. AS 2315.34 defines the tolerable rate as the maximum deviation rate the auditor would accept without changing the planned assessment of control risk.

Two public sources give numbers.

By control frequency. The Implementation Guide for OMB Circular A-123 Appendix A (Chief Financial Officers Council, July 2005, page 36) gives examples of sample sizes based on how often a control is performed, after considering its complexity and whether it is manual or automated:

Sample sizes: what the published guidance says

Control frequency	Example sample size (OMB A-123 Implementation Guide)
Annually	1
Quarterly	2
Monthly	3
Weekly	10
Daily	30
Recurring (multiple times a day)	45

The guide calls these examples and leaves the decision to management's judgment. Firms' own tables differ in the middle rows; what they share is the logic that a control performed a few times a year is tested every time it runs, while a high-volume control is sampled.

By attribute sampling. The GAO/CIGIE Financial Audit Manual (Volume 1, June 2018, section 450) publishes the table it uses for controls that operate more frequently than weekly. At a 90 percent confidence level and a 5 percent tolerable rate, the sample sizes and acceptable numbers of deviations are 45 items with 0 deviations, 78 with 1, 105 with 2, 132 with 3 and 158 with 4 (Figure 450.1, Table I). The manual notes that the tables assume a population over 5,000 items, that 45 is the most efficient size when no deviations are expected, and that if none are found the sample supports reliance (450.08 to 450.12). GAO says its factors fall within the AICPA's audit sampling examples, which are the reference for other confidence levels.

Pick one basis, write it into the methodology with the confidence level and tolerable rate, and record it on every RCM row. A deviation does not automatically fail the control: GAO FAM 450.13 to .14 and AS 2315.41 both require the tester to understand its cause and decide whether the test still supports reliance, whether to extend the sample, or whether to address the risk another way. How to Choose Samples for Control Testing Without Weakening Assurance covers selection methods and exceptions in depth.

The deficiency severity ladder

The three levels are defined in PCAOB AS 2201 Appendix A; the SEC's rules use the same words for material weakness (Rule 12b-2; 33-8810, footnote 18).

The deficiency severity ladder

Level	Definition	Who must be told	Disclosure
Deficiency	The design or operation of a control does not allow management or employees, in the normal course of their work, to prevent or detect misstatements on a timely basis (AS 2201.A3)	Management; the auditor informs the audit committee it has done so (AS 2201.81)	None required
Significant deficiency	Less severe than a material weakness, yet important enough to merit the attention of those responsible for oversight of financial reporting (AS 2201.A11)	Audit committee, in writing (AS 2201.80); management discloses it to the auditor and audit committee under Section 302 (15 U.S.C. 7241(a)(5))	Not required in management's annual report (33-8810, footnote 52)
Material weakness	A deficiency, or combination, such that there is a reasonable possibility that a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis (AS 2201.A7)	Management and audit committee, in writing (AS 2201.78)	Disclosed in management's annual report; management may not conclude ICFR is effective (17 CFR 229.308(a)(3); 33-8810, page 34)

To climb the ladder for a given deficiency, follow 33-8810 pages 35 to 38 and AS 2201.63 to .70:

1. Likelihood. Is there a reasonable possibility, meaning reasonably possible or probable in the FAS 5 sense (footnote 47), of a misstatement? Risk rises with suspense accounts and related parties, assets susceptible to loss or fraud, judgment such as estimates, interdependent controls, interacting deficiencies and future consequences. Severity does not depend on whether a misstatement actually occurred (page 35).
2. Magnitude. The amounts and volume exposed. Overstatement is capped at the recorded amount; understatement is not (page 36).
3. Compensating controls. Count them only if they operate at a level of precision that would prevent or detect a material misstatement (page 37).
4. Aggregation. Deficiencies affecting the same amount, disclosure or component may together be a material weakness even if none is alone (pages 34 to 35).
5. Indicators. Four situations must be evaluated as indicators of a material weakness: fraud, whether or not material, by senior management; restatement to correct a material misstatement; a material misstatement in the current period that ICFR would not have detected; and ineffective audit committee oversight (page 37; AS 2201.69).
6. The prudent official test. If the deficiency might stop prudent officials concluding they have reasonable assurance that transactions are recorded as needed for GAAP statements, treat it as an indicator of a material weakness (page 38).

Record the reasoning on the deficiency record, not in a memo, so the rating can be defended a year later. What is SOX deficiency management? gives the short definition.

SOX Sections 302 and 404: what the law and the rules require

The Sarbanes-Oxley Act of 2002 (Public Law 107-204, 30 July 2002) has two sections that drive control programs.

Section 302 (15 U.S.C. 7241) requires the principal executive and financial officers to certify each annual and quarterly report. Paragraph (a)(4) makes them state that they are responsible for establishing and maintaining internal controls, have designed them so material information reaches them, have evaluated their effectiveness and have presented their conclusions. Paragraph (a)(5) requires them to disclose to the auditors and audit committee all significant deficiencies and material weaknesses, and any fraud, whether or not material, involving management or employees with a significant role in internal controls. Paragraph (a)(6) covers significant changes after the evaluation.

Section 404 (15 U.S.C. 7262). Subsection (a) requires the annual report to contain an internal control report stating management's responsibility for an adequate internal control structure and procedures for financial reporting, with an assessment of their effectiveness as of the end of the fiscal year. Subsection (b) requires the auditor to attest to and report on that assessment as part of the audit, not as a separate engagement; emerging growth companies are excluded. Subsection (c) exempts issuers that are neither large accelerated nor accelerated filers from subsection (b).

The SEC's rules. Exchange Act Rule 13a-15(f) defines internal control over financial reporting (ICFR) as a process, designed by or under the supervision of the principal executive and financial officers, that provides reasonable assurance about the reliability of financial reporting, through records that accurately and fairly reflect transactions, reasonable assurance that transactions are recorded as needed for GAAP statements and that receipts and expenditures are authorized, and reasonable assurance about preventing or detecting unauthorized acquisition, use or disposition of assets. Rule 13a-15(c) requires an evaluation of ICFR as of each fiscal year-end against a suitable, recognized control framework; 13a-15(d) requires a quarterly evaluation of changes that have materially affected, or are reasonably likely to materially affect, ICFR. Item 308 of Regulation S-K (17 CFR 229.308) sets what management's report contains: a statement of responsibility; the framework used; the year-end assessment, with any material weakness disclosed and no conclusion of effectiveness if one exists; and, for accelerated and large accelerated filers, the auditor's attestation report.

Who gets the auditor attestation. Under Rule 12b-2 an accelerated filer has a public float of at least $75 million and under $700 million, and a large accelerated filer $700 million or more. SEC Release 34-88365 (12 March 2020) excluded from both definitions issuers eligible as smaller reporting companies with annual revenues under $100 million, so those issuers keep the Section 302 certifications, the annual management assessment and the financial statement audit but need no 404(b) attestation. The SEC's 2007 interpretive guidance (Release 33-8810, 20 June 2007) is the management-side counterpart to PCAOB AS 2201 and the source of the scoping, evidence and deficiency rules above. The SOX framework page holds the official resources; What is ICFR? and What is SOX compliance? give the definitions.

A SOX 404 walkthrough by phase, with owners

The phases follow the SEC guidance's order, with the auditor's parallel work from AS 2201 noted where it touches management. Owners are roles; in a smaller registrant several will be one person.

A SOX 404 walkthrough by phase, with owners

Phase	What happens	Owner	Output	Source
1 Plan and scope	Set materiality; identify significant accounts, disclosures and relevant assertions; list locations and systems in scope; confirm the framework; agree the timetable with the auditor	CFO as sponsor; ICFR or SOX lead; audit committee informed	Scoping memo; in-scope lists	33-8810, pages 9 to 14 and 33; AS 2201.28 to .33; Rule 13a-15(c)
2 Identify risks and controls	Identify financial reporting risks from GAAP, including fraud; select the controls that adequately address each, starting with entity-level controls; add the ITGCs they depend on; record it in the RCM	Process owners with the ICFR team; IT for ITGCs	RCM with key controls flagged	33-8810, pages 12 to 20
3 Document and walk through	Maintain narratives or flowcharts; walk each significant process from origination to ledger; bring control descriptions to the who, what, when, how, evidence standard	ICFR team with control owners; the auditor performs its own walkthroughs	Walkthrough records; updated RCM	33-8810, page 20; AS 2201.37 to .38
4 Evaluate design	Conclude on the design of each key control; open remediation for design gaps before TOE starts	ICFR team; internal audit for challenge	TOD conclusions; design deficiency log	AS 2201.42 to .43; IIA IG 2130
5 Test operating effectiveness	Set nature, timing and extent by ICFR risk; decide where ongoing monitoring suffices; test at interim and roll forward to year-end; hold evidence in linked records	Internal audit or testers independent of the control; control owners supply populations and evidence	Test results per control for the full period	33-8810, pages 21 to 30; AS 2201.44 to .56
6 Evaluate deficiencies	Rate each deficiency on likelihood, magnitude, compensating controls, aggregation and the four indicators; agree ratings with the auditor early	ICFR lead and controller; disclosure committee; audit committee for significant deficiencies and material weaknesses	Deficiency register with severity and rationale	33-8810, pages 34 to 38; AS 2201.62 to .70
7 Remediate and retest	Fix and retest before year-end where possible; a material weakness remediated and retested before year-end can support an effective conclusion, with disclosure considered	Control owners; ICFR lead; internal audit retests	Retest evidence; open and closed deficiencies at year-end	33-8810, page 10
8 Certify	Process owners sign sub-certifications; CEO and CFO sign the Section 302 certifications quarterly and annually, disclosing significant deficiencies, material weaknesses and fraud to the auditor and audit committee	Process owners; CEO and CFO; general counsel	Sub-certifications; 302 certifications	15 U.S.C. 7241(a); 33-8810, page 34
9 Report and attest	Publish management's report under Item 308(a); the auditor issues its 404(b) report where required and communicates material weaknesses and significant deficiencies in writing	CFO; audit committee; external auditor	Management's report in the Form 10-K; auditor's ICFR report	17 CFR 229.308; 15 U.S.C. 7262; AS 2201.78 to .81
10 Monitor and update	Evaluate quarterly whether any change has materially affected ICFR and disclose it; re-scope for acquisitions, system changes and new standards; in later years focus on change	ICFR lead; process owners; disclosure committee	Quarterly change evaluation; updated RCM	Rule 13a-15(d); Item 308(c); 33-8810, page 6

The connected data model behind this program is in SOX Compliance: Connecting Controls, Evidence, Testing, and Remediation; the finance leader's view is in Connected GRC for Finance Leaders.

Common mistakes

1. Controls written as processes. "Month-end close is performed" cannot be tested. Rewrite to who, what, when, how, evidence, with the threshold.
2. Too many key controls. Management need not identify every control (33-8810, page 4) and may choose, between two adequate controls, the one that is cheaper to evidence (page 16). Every extra key control is a test, a sample and a possible deficiency.
3. Testing operation before fixing design. A design gap found in December is a deficiency for the year.
4. Management review controls without precision. A signature proves someone signed. Without a documented threshold and a record of what was investigated, the control cannot be shown to detect a material misstatement.
5. Incomplete populations. A sample from an incomplete population proves nothing about the items left out. Record the population's source and count before selecting.
6. Ignoring the ITGC dependency. An automated control or system report is only as reliable as the access and change controls over the system that produces it.
7. Evidence in inboxes. Evidence in email cannot be linked to a control, a test or a deficiency, or found again in the auditor's fieldwork. Evidence Quality Checklist for Control Owners sets the standard.
8. Rating deficiencies one at a time, and closing them without a retest. Aggregation is required (33-8810, pages 34 to 35), and a remediated control must operate long enough to be retested with a new sample before the deficiency closes.

How controls link to risks, issues, evidence and frameworks

A control library earns its keep through relationships, and the RCM is where most of them show.

• Risks. Each control links to the risk it modifies, and each risk register row shows the latest test result of its controls, which is what justifies the residual rating. How Controls Connect Risk, Compliance, Audit, and Remediation describes the model.
• Issues. Every deficiency is an issue with an owner, a due date and a retest; see What is remediation tracking?.
• Evidence. Evidence is a record with a period, a source and a link to the control and test it supports, not a file. Evidence Management in GRC and Control Owner Evidence Guide set out what good looks like.
• Frameworks. A control mapped once to COSO principles, SOC 2 criteria and other frameworks is tested once and reported many times. How to Design a Test-Once, Comply-Many Control Framework and SOC 2 vs SOX cover the mapping.
• Internal audit. Internal audit's evaluation under IIA Standard 2130 draws on the same RCM, results and deficiencies; Internal Audit Management in a Connected GRC Program describes the handoff.

How SmartSuite does this

SmartSuite's SOX Compliance product holds the program above as linked records: ICFR control management, IT general controls, control testing and validation, deficiency and issue tracking, evidence collection and management, SOX certification workflows, and dashboards of control effectiveness, deficiencies and audit readiness. The product page names COSO, the PCAOB and the Sarbanes-Oxley Act as the frameworks it aligns to. Workflow automation runs the testing cycle: tests are assigned by control and period, evidence requests go to control owners, results and deficiencies route for review, and sub-certifications roll up to the Section 302 certification.

The control library itself lives in Control Framework & Regulatory Libraries: a centralized control library, multi-framework mapping, control reuse on a test-once, comply-many basis, gap analysis and evidence management, so a control tested for SOX can be reported against SOC 2, ISO or NIST without a second test. Related products cover the rest of this guide: Compliance Assessments & Testing, Internal Audit Management, Issues Management for deficiencies and remediation, and Risk and Control Self-Assessment (RCSA) for first-line self-assessment. The SOX Management solution page shows how they fit together.

Template

The companion file risk-control-matrix-template.csv has 30 columns and three completed example rows: the credit-release control from this guide, a monthly bank reconciliation (detective, IT-dependent manual, key) and a change-management ITGC (preventive, manual, entity-level, on which the first two depend). Import it into a spreadsheet, or use it as the field list when you configure an RCM in a GRC tool.

Template

Column group	Columns
Identity and scope	control_id, process, sub_process, risk_id, risk_description, significant_account, assertion, control_objective
Control attributes	control_description, control_owner, frequency, control_type, nature, key_control, key_control_rationale, level, itgc_dependency, framework_mapping
Testing	test_of_design, test_of_operating_effectiveness, sample_basis, sample_size, tester, test_period, result, deficiency_id, evidence_reference
Cycle	last_tested, next_test, status

Sample sizes in the example rows use the OMB A-123 Implementation Guide examples. Change sample_basis in your methodology document first, then in the file.

FAQs

What is the difference between internal control and internal controls? Internal control, singular, is the process COSO defines: everything the board, management and staff do to get reasonable assurance about operations, reporting and compliance objectives. Internal controls, plural, are the individual control activities inside that process, such as a reconciliation or an approval limit. SOX Section 404 asks management to assess the process; the risk-control matrix lists the controls.

What is a risk-control matrix used for? It is the working record that links each risk to the control that addresses it, the assertion and account affected, the control's attributes, and the tests that prove design and operation. The IIA's guide for Standard 2130 describes it as the tool internal audit uses to identify key controls, evaluate design adequacy and then test operating effectiveness. Management uses the same record to scope and evidence SOX.

What is the difference between a test of design and a test of operating effectiveness? A test of design asks whether the control, if performed as prescribed by someone with the necessary authority and competence, would meet its objective; a walkthrough usually answers it (PCAOB AS 2201.42 to .43). A test of operating effectiveness asks whether the control actually operated that way throughout the period, using inquiry, observation, inspection and re-performance (AS 2201.44 to .45). Design is tested first.

How many samples do I need to test a control? No standard sets a number for management's testing. The OMB A-123 Implementation Guide gives examples by frequency: 1 for annual, 2 quarterly, 3 monthly, 10 weekly, 30 daily and 45 for recurring controls. The GAO Financial Audit Manual's attribute table gives 45 items with zero deviations at 90 percent confidence and a 5 percent tolerable rate. Write your basis into the methodology and record it per control.

What is the difference between a significant deficiency and a material weakness? A material weakness is a deficiency in ICFR where there is a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis; it must be disclosed in management's annual report and prevents a conclusion that ICFR is effective. A significant deficiency is less severe but merits the audit committee's attention; it goes to the audit committee and auditor, not the annual report.

Who has to comply with SOX 404(b)? Section 404(b) applies to accelerated and large accelerated filers, defined in Rule 12b-2 by public float of $75 million and $700 million. Section 404(c) exempts other issuers, and emerging growth companies are excluded. Since SEC Release 34-88365 (2020), issuers eligible as smaller reporting companies with revenues under $100 million are also outside those definitions. All registrants still make the Section 302 certifications and the annual assessment.

Sources

• COSO, Internal Control — Integrated Framework, Executive Summary, Committee of Sponsoring Organizations of the Treadway Commission, May 2013. Definition; three objective categories; five components; seventeen principles; requirements for effective internal control; limitations. https://www.coso.org/guidance-on-ic (Executive Summary PDF as mirrored by the City of Columbia, Missouri: https://www.como.gov/archive/2021/12/COSO-2013.pdf). SmartSuite framework page: https://www.smartsuite.com/frameworks/coso-internal-control-integrated-framework-2013-icfr
• Sarbanes-Oxley Act of 2002, Public Law 107-204, 30 July 2002. Section 302, 15 U.S.C. 7241: https://www.law.cornell.edu/uscode/text/15/7241. Section 404, 15 U.S.C. 7262: https://www.law.cornell.edu/uscode/text/15/7262. Enrolled text: https://www.govinfo.gov/content/pkg/PLAW-107publ204/html/PLAW-107publ204.htm. SmartSuite framework page: https://www.smartsuite.com/frameworks/sox-sarbanes-oxley-act
• US Securities and Exchange Commission, Release No. 33-8810, Commission Guidance Regarding Management's Report on Internal Control Over Financial Reporting Under Section 13(a) or 15(d) of the Securities Exchange Act of 1934, 20 June 2007. Pages 3 to 38 as cited. https://www.sec.gov/rules/interp/2007/33-8810.pdf
• 17 CFR 240.13a-15 (Exchange Act Rule 13a-15), Controls and procedures, paragraphs (c), (d), (e) and (f). https://www.law.cornell.edu/cfr/text/17/240.13a-15
• 17 CFR 240.12b-2, definitions of accelerated filer and large accelerated filer. https://www.law.cornell.edu/cfr/text/17/240.12b-2
• 17 CFR 229.308 (Regulation S-K Item 308), Internal control over financial reporting. https://www.law.cornell.edu/cfr/text/17/229.308
• US Securities and Exchange Commission, Release No. 34-88365, Accelerated Filer and Large Accelerated Filer Definitions, 12 March 2020 (press release 2020-58). https://www.sec.gov/news/press-release/2020-58
• PCAOB, AS 2201, An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements. Paragraphs 3, 21 to 33, 37 to 38, 42 to 56, 60, 62 to 70, 78 to 81, A3, A7, A9, A10, A11, B10, B28 to B33. https://pcaobus.org/oversight/standards/auditing-standards/details/AS2201
• PCAOB, AS 2110, Identifying and Assessing Risks of Material Misstatement, paragraphs 18 to 40 and 59 to 60. https://pcaobus.org/oversight/standards/auditing-standards/details/AS2110
• PCAOB, AS 1105, Audit Evidence, paragraph 11. https://pcaobus.org/oversight/standards/auditing-standards/details/AS1105
• PCAOB, AS 2315, Audit Sampling, paragraphs 31 to 41. https://pcaobus.org/oversight/standards/auditing-standards/details/AS2315
• The Institute of Internal Auditors, Implementation Guide, Standard 2130 – Control (International Standards for the Professional Practice of Internal Auditing, revised standards effective 1 January 2017). https://www.theiia.org/globalassets/documents/standards/implementation-guides-gated/ig-for-standards/iia-ig---standard-2130--control.pdf
• US Government Accountability Office and Council of the Inspectors General on Integrity and Efficiency, Financial Audit Manual, Volume 1, June 2018 (GAO-18-601G), section 450 Sampling Control Tests, Figure 450.1. https://www.gao.gov/financial-audit-manual (June 2018 PDF: https://www.ignet.gov/sites/default/files/files/692494.pdf)
• Chief Financial Officers Council, Implementation Guide for OMB Circular A-123, Management's Responsibility for Internal Control, Appendix A, Internal Control over Financial Reporting, July 2005, page 36. https://bidenwhitehouse.archives.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A123/a123_appx_a_implementation_guide.pdf
• IT Governance Institute (ISACA), IT Control Objectives for Sarbanes-Oxley, 2nd edition, 2006 (IT general control domains; application control examples). https://leeds-faculty.colorado.edu/marlattj/acct45405540/ITGI_SOX404_ITControls%20-%20Final.pdf. Current edition: ISACA, IT Control Objectives for Sarbanes-Oxley, 4th edition, https://www.isaca.org/store2/product/PSOX4

Related: GRC Foundation · Controls, Evidence, Issues & Testing · What are internal controls? · What is a risk control matrix (RCM)? · What is ICFR? · COBIT 2019