Key control · Concepts · European Finance Observatory

Roles that need it

SOX controls (ICFR)SOX controls are the internal controls over financial reporting (ICFR) that US-listed companies must document, test and report on under the Sarbanes-Oxley Act, sections 302 and 404. Management assesses them each year and, for larger filers, the external auditor gives an opinion on their effectiveness.
Control testing (design and operating effectiveness)Control testing checks whether a control is well designed to address its risk (design effectiveness) and whether it worked as intended over a period (operating effectiveness). Testers walk through the process, sample instances and inspect evidence.
RCSA (risk and control self-assessment)A risk and control self-assessment is the periodic exercise in which a business unit identifies its operational risks, rates inherent risk, assesses how well its controls work and derives the residual risk. Results are challenged by the second line and lead to actions where residual risk exceeds appetite.
Account reconciliation (balance sheet reconciliation)Account reconciliation compares a ledger balance with independent evidence, such as a bank statement, a sub-ledger or a counterparty confirmation, and explains every difference. Reviewed and signed-off reconciliations are a common key control.

Updated 31 Oct 2026.