How SOX and internal audit fit together
Your internal auditors and your SOX team both examine the controls behind financial reporting, and they answer to different people. Management owns the 404(a) assessment and cannot rest it on the work of the firm that audits your financial statements.
500+
audit and attestation engagements
AICPA
peer-reviewed firm
16+
years auditing experience
Which companies need SOX and internal audit
SEC reporting companies complete the SOX work the SEC requires of them. Each company decides whether it needs an internal audit function: NYSE requires one under its listing rules, while Nasdaq does not. When a company maintains the function, its staff can support the SOX program without replacing management or the outside auditor.
Internal auditors and SOX teams overlap on controls over financial reporting. Outside that work, they examine different risks and report to different people.
What SOX and internal audit each cover
SOX
SEC reporting companies must assess internal control over financial reporting, subject to transition rules for newly public companies. Management identifies the accounts and processes where the company could record a material misstatement, assesses the controls each year, and reports the result in the annual filing.
Internal audit
The board or owner sets its mandate. Private companies choose whether to establish it unless a regulator or an industry body requires one. The board approves a yearly plan covering financial reporting, operations, compliance or fraud risk, and receives the results.
Who is allowed to do which part of the SOX work
Under 404(a), management assesses and reports on internal control over financial reporting. Under 404(b), the firm that issues the audit report attests to and reports on that assessment. In 15 U.S.C. 7262, Congress requires the attestation to form part of the audit, and exempts emerging growth companies and issuers that are neither large accelerated filers nor accelerated filers. The SEC sets those categories by public float and, for some smaller reporting companies, revenue.
Ask who signs your financial statements first. Your internal auditors can test controls and give management evidence for its 404(a) assessment. We can do that work too, when another firm audits the financial statements.
For a company we audit, we cannot perform management's 404(a) assessment. We test internal control over financial reporting inside the integrated audit and issue the 404(b) opinion. Management still makes its own assessment and cannot rest it on our procedures.
Who on your own team can test a SOX control
Under Standard 2.2 of the Global Internal Audit Standards, an internal auditor's objectivity is presumed impaired if they provide assurance on an activity they were responsible for in the previous 12 months. If a member of your internal audit team designed or ran a control in that period, someone else tests it. We can test those controls for you.
What internal auditors handle in a SOX program
A company with its own internal audit function can put that team on the SOX audit process itself:
Scoping
Walkthroughs and documentation
Design assessment
Operating effectiveness testing
Deficiency evaluation
Retesting
If another firm signs your financial statements
When another firm audits your financial statements, we can handle SOX readiness and 404(a) testing. See our SOX compliance audit services for scope, timing and what a first year looks like.
When your outside auditor can use internal audit's SOX testing
Under PCAOB AS 2201, the firm that audits your financial statements may use your internal auditors' control testing to reduce its own. It weighs three things:
The auditor should not use the work of a team with low objectivity, however competent, or with low competence, however objective. We structure 404(a) testing so your auditor can use it. The auditor repeats testing it cannot use.
Competence
The training and experience of the people who did the testing.
Objectivity
Whether those people report outside the process they tested.
Risk
The higher the risk of the control, the more of its own testing the auditor performs.
ICFR vs SOX and the role of internal audit
ICFR is your set of controls over financial reporting; SOX is the law under which SEC reporting companies assess and report on those controls each year. A SOX internal audit means your internal audit function supporting management's 404(a) work on those controls.
SEC reporting companies connect SOX and internal controls through the annual ICFR assessment. Your board and management decide how much of that testing your internal auditors perform.
Related services
- SOX compliance audits
- Internal audit services
- Financial statement audits
- Agreed-upon procedures
- Internal audit outsourcing
Treat the information as general, not advice for your circumstances. Ask a CPA to review your filer status and independence before you appoint anyone to either role.
How we set the cost of the SOX work we take on
We set the fee on four things:
Processes and controls in scope
We charge more for five processes than for two.
Systems and locations
We add hours for each system with controls we test and for each site.
First year or repeat year
We charge more for walkthroughs and documentation from scratch than for updating last year's.
Your team's existing testing
Where your team has tested controls in a form your auditor can use, we write that testing up and charge less than for fresh testing.
Tell us who audits your financial statements
The firm that audits your financial statements decides which SOX work we can take. Send that firm's name with your filer status and first reporting deadline. A CPA reviews it and returns a scope and a price.
Contact
Connect with Dimov Audit
Our dedicated team is ready to assist you on your path to financial success.
24 Mercer St, 2nd Floor, Suite 214
New York, NY 10013
United States
Reviewed by George Dimov, CPA. Dimov Audit works on SOX readiness and internal audit for public and pre-IPO companies across all 50 states. George brings 20+ years of accounting and consulting experience. Profile