SOX explained: ICFR, COSO 2013 and the Section 404 certification

The Sarbanes-Oxley Act of 2002 was Congress's answer to Enron and WorldCom. Its heart is Internal Control over Financial Reporting, or ICFR: the process that gives reasonable assurance your financial statements are reliable. SOX makes that process the personal responsibility of the chief executive and chief financial officer, who certify it every quarter and every year.

Three jobs, not one

• Certifications and disclosure controls: the CEO and CFO certify each report under Section 302, with a separate criminal certification under Section 906, backed by disclosure controls and a sub-certification process.
• ICFR: management assesses control effectiveness as of year-end under Section 404(a); accelerated filers also get the external auditor's attestation under Section 404(b).
• Governance and auditor independence: an independent audit committee, a whistleblower channel, a code of ethics, clawbacks and records retention.

COSO 2013 is the backbone

The SEC expects management to use a recognised control framework, and in practice that is COSO 2013, the Internal Control–Integrated Framework. It has five components (control environment, risk assessment, control activities, information and communication, monitoring) and seventeen principles, all of which must be present and functioning. The external auditor's work follows the PCAOB's AS 2201, a top-down, risk-based approach that starts at materiality, identifies significant accounts and their relevant assertions, and tests the controls that matter.

What Section 404 really asks

Section 404 is not a document; it is a conclusion backed by evidence. You scope significant accounts, build a risk-and-control matrix, walk through and test key controls for design and operating effectiveness, evaluate any deficiencies, and conclude whether ICFR is effective. A single material weakness means it is not, and that is disclosed publicly.

SOX is a signature with teeth. The work is proving, with evidence, that the controls behind that signature actually operate.