SOX 404 / ICFR

United States

vAS 2201 (revised 2020)

7 domains

19 controls

Sarbanes‑Oxley Act of 2002, Section 404 - Internal Control over Financial Reporting (ICFR), assessed and reported by management and audited in accordance with PCAOB Auditing Standard AS 2201 (revised 2020), based on the COSO Internal Control - Integrated Framework (2013).

Verified

SOX 404 / ICFR is a compliance framework from United States with 7 domains and 19 controls. The largest domains are Entity Level Control Activities (10 controls), Fraud Risk and Management Override (4 controls), Business Process (1 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (7)

Business Process

1 controls

Controls in the Business Process domain of SOX 404 / ICFR — 1 controls
Code	Title	Description
SOX404-3	Business Process Controls (Revenue, Procurement, HR, Inventory)	Per SOX 404: business process controls including Revenue + Procure-to-Pay + HR/Payroll + Inventory + Treasury + each tie...

Deficiency

1 controls

Controls in the Deficiency domain of SOX 404 / ICFR — 1 controls
Code	Title	Description
SOX404-5	Deficiency Evaluation and Remediation	Per SOX 404 + PCAOB AS 2201: deficiency evaluation + classification + remediation + retest.

Entity Level Control Activities

10 controls

Controls in the Entity Level Control Activities domain of SOX 404 / ICFR — 10 controls
Code	Title	Description
ENT-1	Code of Conduct and Ethics	A board-approved code of conduct exists, is communicated to all employees, and acknowledgement is obtained at hire and a...
ENT-10	CEO/CFO Sub-Certification Process	Sub-certifications from process owners support CEO/CFO Section 302 and 906 certifications.
ENT-2	Audit Committee Oversight	The audit committee oversees ICFR, financial reporting, and external auditor independence with documented charter and me...
ENT-3	Whistleblower / Ethics Hotline	Anonymous reporting mechanism exists for accounting and audit concerns with audit committee escalation.
ENT-4	Risk Assessment Process	Management performs annual ICFR risk assessment identifying significant accounts, disclosures, and risks of material mis...
ENT-5	Delegation of Authority	Board-approved delegation of authority matrix defines approval limits for commitments, expenditures, and contracts.
ENT-6	Hiring and Background Checks	Background checks are performed for personnel in roles with financial reporting responsibility.
ENT-7	Performance Evaluation and Compensation	Performance reviews and incentive compensation align with control responsibilities and ethical behavior.
ENT-8	Internal Audit Function	Internal audit reports functionally to the audit committee and executes risk-based audit plan covering ICFR.
ENT-9	Disclosure Committee	Disclosure committee reviews periodic SEC filings (10-K, 10-Q) and certifies completeness and accuracy of disclosures.

Entity-Level

1 controls

Controls in the Entity-Level domain of SOX 404 / ICFR — 1 controls
Code	Title	Description
SOX404-1	Entity-Level Controls (ELC)	Per Sarbanes-Oxley Section 404 + PCAOB AS 2201: Entity-Level Controls. Requirements include (a) control environment + (b...

FRP

1 controls

Controls in the FRP domain of SOX 404 / ICFR — 1 controls
Code	Title	Description
SOX404-2	Period-End Financial Reporting Process (FRP)	Per SOX 404: Period-End FRP including account reconciliations + close checklist + management review + significant estima...

Fraud Risk and Management Override

4 controls

Controls in the Fraud Risk and Management Override domain of SOX 404 / ICFR — 4 controls
Code	Title	Description
FRAUD-1	Fraud Risk Assessment	Annual fraud risk assessment identifies schemes, considers incentives/pressures, opportunities, and rationalizations.
FRAUD-2	Management Override Controls	Controls mitigate management override risk including independent review of top-side journal entries and unusual transact...
FRAUD-3	Journal Entry Review and Approval	Manual journal entries are reviewed and approved by someone other than the preparer with supporting documentation.
FRAUD-4	Conflict of Interest Disclosure	Annual conflict of interest disclosures are obtained from directors, officers, and key employees.

ITGC

1 controls

Controls in the ITGC domain of SOX 404 / ICFR — 1 controls
Code	Title	Description
SOX404-4	IT General Controls (ITGC) - Access, Change, Operations	Per SOX 404 + COBIT: ITGC including access management + change management + computer operations + program development +...

What is SOX 404 / ICFR and who does it apply to?

SOX 404 / ICFR is a compliance framework from United States with 7 domains and 19 controls. Sarbanes‑Oxley Act of 2002, Section 404 - Internal Control over Financial Reporting (ICFR), assessed and reported by management and audited in accordance with PCAOB Auditing Standard AS 2201 (revised 2020), based on the COSO Internal Control - Integrated Framework (2013). It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does SOX 404 / ICFR actually require?

SOX 404 / ICFR has 19 controls organised across 7 domains. The largest domains are Entity Level Control Activities (10 controls), Fraud Risk and Management Override (4 controls), Business Process (1 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of SOX 404 / ICFR do I already cover?

SOX 404 / ICFR does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.

How do I implement SOX 404 / ICFR?

Start your SOX 404 / ICFR compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about SOX 404 / ICFR requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 19 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 868 frameworks.

Get Started Free →

Free forever — no credit card required