Which COSO framework does SOX use?

COSO 2013, the Internal Control–Integrated Framework, is the recognised framework the SEC accepts and virtually every US issuer uses for its §404 assessment. Compliance One ships all five components and seventeen principles verbatim.

Do we need the §404(b) auditor attestation?

Only accelerated and large-accelerated filers do. Non-accelerated filers and emerging growth companies do management's §404(a) assessment but are exempt from §404(b). It is modelled as filer-conditional and promotable.

What is a material weakness?

A deficiency, or combination, such that there is a reasonable possibility a material misstatement would not be prevented or detected on time. It makes ICFR 'not effective' and must be disclosed. It turns on the possibility of failure, not whether a misstatement actually happened.

We already have SOC 2 and ISO 27001. Does that help?

Yes. SOC 2's CC1 to CC5 criteria are the 17 COSO principles, and ITGCs recur across all three. Compliance One cross-maps them so you re-use evidence, with the caveat that security evidence is re-scoped to the financial-reporting objective before you rely on it for SOX.

All frameworks

SOXSOX 2002 · COSO 2013 · PCAOB AS 2201

SOX compliance

The US public-company rulebook for trustworthy financial reporting.

The Sarbanes-Oxley Act requires US public companies to establish, assess and certify Internal Control over Financial Reporting (ICFR). Compliance One ships SOX built on the COSO 2013 framework and the PCAOB's AS 2201 top-down, risk-based approach: the 17 COSO principles, the significant business cycles, the §302 and §404 certifications, and a deficiency model that classifies findings the way an auditor does.

Start from the basics

The standard

Sarbanes-Oxley Act (SOX) — Internal Control over Financial Reporting (ICFR)

Who needs it

US SEC registrants (issuers), including foreign private issuers and companies preparing for an IPO. Every issuer does management's §404(a) assessment; accelerated and large-accelerated filers also get the auditor's §404(b) attestation. Pre-IPO companies build ICFR early so they can certify from their first report.

COSO principles, fully mapped

The basics

What is SOX?

SOX splits into three jobs. First, certifications and disclosure controls: the CEO and CFO personally certify each quarterly and annual report (§302 and §906), backed by disclosure controls and a sub-certification process. Second, ICFR: management assesses, and the auditor attests (for accelerated filers), that controls over financial reporting are effective as of year-end (§404) using a recognised framework, in practice COSO 2013.

Third, governance and auditor independence: an independent audit committee, a whistleblower channel, a code of ethics, clawbacks and records retention. The engine room is the Risk and Control Matrix, where significant accounts, assertions, controls and tests meet, and the deficiency model, which grades every gap as a control deficiency, a significant deficiency or a material weakness on a likelihood-and-magnitude basis.

Why it matters

What SOX does for your business

Personal officer liability

The §302 and §906 certifications are signed by the CEO and CFO personally, with criminal penalties for a knowing false certification. This is not a box-tick; it is a signature with teeth.

A material weakness is public

One material weakness means ICFR is 'not effective', full stop. It is disclosed in the 10-K and read by every investor, lender and auditor. There is no 'effective except for' option.

It is the IPO entry fee

You cannot go public, or stay public, without a working ICFR programme. Building it early is the difference between a clean first year and a restatement scramble.

What it covers

COSO 2013 backbone

All five components and seventeen principles, present and functioning, from control environment to monitoring, mapped to entity-level and process controls.

The business cycles

Key controls across revenue (ASC 606), procure-to-pay, payroll, inventory, fixed assets, the financial close (including topside journal entries), treasury, and tax (ASC 740).

Certifications & disclosure

The §302/§906 certification and sub-certification flow, disclosure controls, management's §404(a) report and the §404(b) attestation.

Deficiency model

Every gap evaluated by likelihood and magnitude, aggregated, and classified as a control deficiency, significant deficiency or material weakness, with the prudent-official test.

The hard way

Run by hand, SOX is a year-long relay of spreadsheets: a risk-and-control matrix that drifts from reality, walkthroughs and tests tracked in email, deficiencies argued over without a consistent model, and a quarterly scramble to collect sub-certifications. That is exactly the deadline-driven, evidence-heavy work software should carry.

The easier way, with Compliance One

Ships SOX as a full track on COSO 2013 and PCAOB AS 2201: the 17 principles, the ten business cycles, the certification and governance controls, scoping and the deficiency model.
Reuses your IT controls through the dedicated ITGC hub (COSO principle 11), so access, change and operations evidence is not re-gathered for SOX.
Cross-maps the COSO principles one-to-one to SOC 2 (CC1 to CC5) and to ISO 27001, so a company already running those re-uses evidence, re-scoped to the financial-reporting objective.
Treats the §404(b) auditor attestation and the §304 clawback as filer- and event-conditional, so your matrix reflects your actual filer status.

Do it once, reuse it everywhere. Evidence you collect for SOX is automatically mapped to every other framework whose controls it also satisfies — and since these standards overlap heavily, most of that work isn't repeated.

Common questions

Which COSO framework does SOX use?: COSO 2013, the Internal Control–Integrated Framework, is the recognised framework the SEC accepts and virtually every US issuer uses for its §404 assessment. Compliance One ships all five components and seventeen principles verbatim.
Do we need the §404(b) auditor attestation?: Only accelerated and large-accelerated filers do. Non-accelerated filers and emerging growth companies do management's §404(a) assessment but are exempt from §404(b). It is modelled as filer-conditional and promotable.
What is a material weakness?: A deficiency, or combination, such that there is a reasonable possibility a material misstatement would not be prevented or detected on time. It makes ICFR 'not effective' and must be disclosed. It turns on the possibility of failure, not whether a misstatement actually happened.
We already have SOC 2 and ISO 27001. Does that help?: Yes. SOC 2's CC1 to CC5 criteria are the 17 COSO principles, and ITGCs recur across all three. Compliance One cross-maps them so you re-use evidence, with the caveat that security evidence is re-scoped to the financial-reporting objective before you rely on it for SOX.

Ready to tackle SOX?

See exactly how Compliance One maps SOX to your environment in a 30-minute walkthrough — and how much of it we handle for you.