The most contentious aspect of SOX is Section 404, which requires management and the external auditor to report on the adequacy of the company's internal controls over financial reporting (ICFR). This is the most costly aspect of the legislation for companies to implement, as documenting and testing important financial manual and automated controls requires enormous effort.^[32] This course provides an overview of SOX Section 404 and discusses how one can effectively implement a solid program to address the needs of SOX 404. 

The Public Company Accounting Oversight Board (PCAOB) approved Auditing Standard No. 5 for public accounting firms on July 25, 2007.^[33] This standard superseded Auditing Standard No. 2, the initial guidance provided in 2004. The SEC also released its interpretive guidance ^[34] on June 27, 2007. These two standards together require management to:

• Assess both the design and operating effectiveness of selected internal controls related to significant accounts and relevant assertions, in the context of material misstatement risks;
• Understand the flow of transactions, including IT aspects, in sufficient detail to identify points at which a misstatement could arise;
• Evaluate company-level (entity-level) controls, which correspond to the components of the COSO framework;
• Perform a fraud risk assessment;
• Evaluate controls designed to prevent or detect fraud, including management override of controls;
• Evaluate controls over the period-end financial reporting process;
• Scale the assessment based on the size and complexity of the company;
• Rely on management's work based on factors such as competency, objectivity, and risk;
• Conclude on the adequacy of internal control over financial reporting.

Sarbanes-Oxley Act was passed in 2002 and year one of attestation for publically traded companies was 2004.  SOX 404 is the most prominent of the many requirements covered under the legislation. Examining and putting into practice a suitable methodology for SOX compliance with SOX 404 is crucial. 

Taking this course will prepare you to successfully address the challenges of Section 404 at your company - a high profile and critical process!

Information within this course comes from readily available public domain documents and is utilized by the trainer as a supplement for relaying the course content.

Note: The concepts outlined in this course are up to date and relevant in regards to the Sarbanes-Oxley legislation. Although there have not been any changes in the legislative concepts of the law since it’s release in 2002, some aspects of executing the work have evolved. This speaker is preparing a series of courses titled “Sarbanes-Oxley 20 years later”. Those courses can be found individually on the platform and would be beneficial for anyone involved with compliance.

NOTE: The Instructor has created 5 new segments on Sarbanes-Oxley Update - 20 Years Later:
Sarbanes-Oxley Update - 20 Years Later: Accounting Risk Assessment Considerations
Sarbanes-Oxley Update - 20 Years Later: Sourcing Emerging Risks Part 1
Sarbanes-Oxley Update - 20 Years Later: Evaluating Testing Processes
Sarbanes-Oxley Update - 20 Years Later: Sourcing Emerging Risks Part 2
Sarbanes-Oxley Update - 20 Years Later: Examining Fraud Risks