SOX controls (ICFR)

Roles that need it

• Internal Auditor
• IT Auditor
• External Audit Associate
• General Accountant
• Business Controller

Skills it belongs to

• Internal controls and risk oversight
• IT general controls and SOX ITGC
• Audit methodology

Related concepts

• Key controlA key control is a control that on its own, or with a few others, prevents or detects a material error or a significant risk. Key controls are documented with an owner, frequency and evidence, and are tested more often than other controls.
• Control testing (design and operating effectiveness)Control testing checks whether a control is well designed to address its risk (design effectiveness) and whether it worked as intended over a period (operating effectiveness). Testers walk through the process, sample instances and inspect evidence.
• Segregation of duties (SoD)Segregation of duties splits incompatible tasks, such as initiating, approving, recording and reconciling a payment, between different people or system roles. It reduces the risk that one person can make and hide an error or fraud.
• Internal auditInternal audit is the independent function that gives the board assurance on governance, risk management and internal controls. In the three lines model it is the third line, reporting to the audit committee. Banking rules require it to be independent of the activities it audits.

Sources

• AS 2201 An Audit of Internal Control Over Financial Reporting, PCAOB (external site) accessed 31 Oct 2026

Updated 31 Oct 2026.