The SOX Compliance Handbook: A Practitioner's Guide to Building, Testing and Defending ICFR (The SOX Lifecycle Series)

The operating manual for the person who is accountable for the program. Most SOX programs do not fail on testing. They fail on scoping, on evidence, and on the unwillingness to call a deficiency what it is. This handbook is written for the Controller, CFO, SOX program manager or internal audit lead who has to run the program and does not have a Big 4 team behind them.

Twenty chapters and seven appendices take the program end to end:

The thirteen-stage SOX lifecycle, with business process controls and ITGC running in parallel rather than in sequence Scoping, materiality and risk assessment at the level of detail an external auditor will accept Control identification and RCM build, including management review controls and the four elements they must evidence Walkthroughs, sample selection and test of operating effectiveness, and the evidence each step must produce Deficiency conclusions you can defend: severity, aggregation and the prudent official test Management's assessment under Section 404(a), and how to support the external audit under Section 404(b) Appendices built for reuse: glossary, RCM field dictionary, sample size reference, deficiency severity matrix, scoping memo outline and auditor PBC checklist Every regulatory statement is verified against a primary source and cited by paragraph so you can check it yourself. Where a position is professional convention rather than a rule, it is labelled as such. Nothing is invented and nothing is implied to be an official publication.

Written for: US-listed companies, foreign private issuers, and pre-IPO companies preparing for a first Section 404 audit.