What it means
Compliance starts with scoping, which decides how much of the business needs formal controls. Teams set a materiality figure, identify the accounts and business units large enough to matter, and map the processes that feed those accounts.
Documentation comes next, usually as process narratives and a risk and control matrix listing each risk, the control that addresses it, who performs it and what evidence it leaves behind. This step is where most of the first-year effort goes, because much of the knowledge exists only in people's heads.
Testing then checks two things separately: whether the control is designed to catch the risk at all, and whether it operated consistently across the period. A monthly reconciliation reviewed by a manager might be well designed and still fail testing if the review signature is missing for three months out of twelve.
Failures are classified by severity, from a control deficiency through a significant deficiency to a material weakness, and only the most serious must be disclosed publicly. Management then remediates, retests, and documents that the fixed control operated long enough to be relied upon.
The nuance that determines whether a compliance programme is bearable is automation and scope discipline. Companies that test 400 controls manually every quarter drown in evidence, while those that rely on well-designed system controls and a tightly scoped population get through the same assurance with far less effort.
In practice
Real-world examples.
Example
A retail group discovers during testing that store managers can both create a supplier and approve payments to it. The control is redesigned to split the two rights, and the team retests over three months before the year-end assertion.
Example
A software company reduces its tested control count from 310 to 190 by replacing manual approval checklists with system-enforced workflow rules. Audit fees fall the following year because the auditor can test one automated control instead of sampling 40 manual approvals.
Example
A manufacturer's finance team keeps a quarterly evidence pack for every key control, storing screenshots, sign-offs and reconciliations in a single repository. When the auditor requests support in November, the pack is produced in a day rather than a fortnight.
Think of it
“SOX compliance is meeting the Sarbanes-Oxley requirements-following the rules.
Formula
Calculation
Scoping is the quantitative heart of the programme. Overall materiality = pre-tax income x a chosen percentage, typically 5%; performance materiality = overall materiality x 75%; and location coverage = revenue of in-scope locations / total revenue.
Take a group with pre-tax income of $40,000,000 and revenue of $600,000,000. Overall materiality is $40,000,000 x 5% = $2,000,000, and performance materiality, the tighter threshold used when testing individual accounts, is $2,000,000 x 75% = $1,500,000.
For location scoping, the group has eight operating sites. The three largest generate $250,000,000, $140,000,000 and $60,000,000 of revenue, a combined $250,000,000 + $140,000,000 + $60,000,000 = $450,000,000. That is $450,000,000 / $600,000,000 = 75% of group revenue, comfortably above the two thirds coverage most auditors expect, so the remaining five sites can be handled with lighter analytical procedures. Any single account balance below the $1,500,000 performance materiality is unlikely to need full control testing unless it carries a specific fraud or estimation risk.Case study
Seen in the real world.
Penhale Logistics is an illustrative, fictional freight business in its third year as a listed company. Its SOX programme had grown by accretion: every audit query added a control, and nobody ever removed one, so the matrix had swollen to 480 controls across 11 locations.
A new head of internal audit rescoped the programme from first principles. Using pre-tax income of $28,000,000, she set overall materiality at $1,400,000 and found that four locations covered 71% of revenue, allowing seven small depots to move out of full scope. The control count fell to 205, and 60 of those became automated system controls rather than manual reviews.
The fictional result was that testing hours dropped by roughly 40% while the auditor's coverage conclusion improved, because attention shifted from counting controls to testing the ones that genuinely protected material balances.
Watch out
Common mistakes.
- Confusing having a control with evidencing it. If a reviewer cannot show when the review happened and what they checked, the control fails testing regardless of how carefully it was performed.
- Adding controls without ever retiring any. An oversized matrix costs money and dilutes attention on the controls that actually matter.
- Leaving IT out of scope. Access rights, change management and automated calculations underpin most financial controls, so weak IT general controls undermine everything above them.
Questions
People also ask.
What is the difference between a significant deficiency and a material weakness?
Both are control failures, but a material weakness creates a reasonable possibility of a material misstatement and must be disclosed publicly.
How long does remediation take?
A fixed control usually needs to operate for at least one full quarter, and often two, before management can assert it is effective.
Can smaller listed companies get relief?
Yes, non-accelerated filers still make a management assertion but are exempt from the external auditor's attestation on internal control.
From the founder's library
Take it further with the book.
Build your financial confidence beyond this definition. Shihan's full-length guide, Accounting Fundamentals, takes the same plain-English approach and turns it into a complete, practical playbook for non-finance managers, business owners and students - with chapter-end quiz answers and presentation slides included.
25% off with code MMHQ25, applied at checkout. Priced in USD - checkout may show the equivalent in your local currency.
View the book and save 25%