SOX Compliance Consulting

SOX does not name specific software or configuration requirements. It requires that management design controls sufficient to prevent or detect a material misstatement in the financial statements, and that those controls operate consistently enough to be independently tested. In practice, for any organisation running SAP, Oracle, Dynamics 365, or a comparable platform, this means the ERP has to enforce — not just document — segregation of duties, restrict configuration changes to an approved change-control process, and produce an audit trail an external auditor can sample without relying on a spreadsheet maintained outside the system.

The distinction that trips up most first-time SOX programmes is the gap between a control that exists and a control that is evidenced. A three-way match between purchase order, receipt, and invoice might run correctly in production for years, but if nobody can show the auditor how that match is enforced, when it was last tested, and what happens on an exception, the control does not count for 404 purposes. This is why ERP-layer SOX work is as much about configuration review and evidence design as it is about the control itself.

Section 302 is a quarterly certification. The CEO and CFO attest that the financial statements fairly present the company's condition and that they have evaluated the effectiveness of disclosure controls and procedures within 90 days of the report. It is a management representation, not an independent audit.

Section 404 is broader and annual. Management must document and test ICFR, and accelerated filers (generally companies with a public float above $75 million) must also have their external auditor independently test and opine on that assessment under PCAOB AS 2201. Non-accelerated filers file a management assessment (404(a)) without the auditor attestation (404(b)) required of larger companies. The ERP control set that supports 302 is a subset of what supports 404 — 404 additionally requires walkthroughs, control testing samples, and remediation tracking that 302 alone does not.

The COSO 2013 Internal Control – Integrated Framework is the dominant methodology used to structure ICFR assessments, and it organises controls into five components: control environment, risk assessment, control activities, information and communication, and monitoring. Most ERP-specific work sits inside control activities and information/communication — the configuration that enforces segregation of duties, the workflow that routes a journal entry for approval, the report that flags a user with conflicting access.

IT general controls (ITGCs) are the layer beneath application-level controls: access provisioning and deprovisioning, change management for configuration and code, and backup/recovery. A well-designed application control (say, a three-way match) is only as reliable as the ITGCs governing who can change the matching tolerance or override the control. Auditors test ITGCs first, because a failure there undermines reliance on every application control downstream.