SOX Compliance

Covering All the Bases: Check Out the FloQast SOX Compliance Checklist

Is your company compliant with the Sarbanes-Oxley (SOX) Act of 2002? If you’re not sure, don’t worry—you’re not alone. The good news is that compliance is largely a matter of organization and process.

By taking advantage of available resources and following a few simple steps, you can ensure your company meets all the requirements of the SOX Act. This blog post provides an overview of SOX compliance and a SOX compliance checklist to help you get started.

Why do you need a SOX compliance checklist?

Public and private companies need SOX compliance checklists to ensure they comply with SOX. The Sarbanes-Oxley Act  is a comprehensive piece of legislation that lays out specific requirements for publicly traded companies related to financial reporting, internal controls, and corporate governance.

Private companies can also benefit from a SOX compliance checklist, as it can help them establish best practices for financial reporting and internal controls. By taking the time to develop and implement a SOX compliance checklist, your company can help protect itself from financial and reputational damage in the event of a data breach, financial misstatement, or other compliance issues.

What are the requirements of a SOX audit?

Public companies (and private companies that need audited financial statements) need an annual SOX audit to ensure that they have internal controls in place and the controls are functioning as intended.

A SOX audit generally involves:

• Documenting the company’s system of internal controls
• Identifying risks associated with the company’s business processes
• Testing the design and operating effectiveness of the company’s internal controls
• Reviewing accounting procedures and records
• Interviewing management and other employees involved in financial reporting
• Analyzing information technology controls

How to use the SOX compliance checklist

The Sarbanes-Oxley Act doesn’t dictate specific controls. Instead, it requires organizations to design and implement their own controls that meet the regulation’s goals.

A SOX compliance checklist can help ensure that a company follows best practices and SOX compliance requirements.

When using a SOX compliance checklist, it’s essential to familiarize yourself with the requirements of the Sarbanes-Oxley Act. The SOX Act covers a wide range of topics, so make sure you are aware of which sections apply to your company. You should tailor your SOX compliance checklist to fit your company’s unique needs. Not all companies need to implement all the controls listed in a SOX compliance checklist.

It’s also important to keep in mind that complying with SOX is an ongoing process. You may need to update your SOX compliance checklist as your business changes.

SOX Compliance Checklist

The following SOX compliance checklist will help you maintain a system of internal controls over your financial reporting.

Task 1: Select an internal control framework

Several industry groups have developed internal control frameworks to help organizations take a systematic approach to comply with SOX. Two commonly used frameworks are:

• Committee of Sponsoring Organizations (COSO). The COSO framework addresses five components of internal control: the control environment, risk assessment, control activities, information and communication, and monitoring activities.
• Control Objectives for Information and Related Technologies (COBIT). The COBIT framework is based on five key principles that apply to IT enterprise governance: meeting stakeholder needs, covering the enterprise end-to-end, applying a single integrated framework, enabling a holistic approach, and separating governance from management.

Task 2: Identify internal and external risks

The next step in following SOX compliance standards is identifying and examining both internal and external risks. Since risk factors are continually changing based on things such as operational expansions, the current economic climate, or new industry standards, assessing risk should be an ongoing effort.

Task 3: Implement controls

Based on your identified risks, identity and implement an adequate internal control structure to protect the integrity of data flowing into your financial statements and other financial reports.

Some examples include:

• Segregation of duties. Spread responsibilities for financial reporting across multiple people. For example, you might require your accounts payable person to get a manager’s sign-off before issuing payments.
• Code of conduct. Companies should create a code of conduct that includes high-level guidelines for behavior and principles to guide decision-making. For example, it might provide guidance on complying with the Foreign and Corrupt Practices Act rules regarding gifts, gratuities and entertainment for employees traveling in a foreign country for work. Make sure all employees have a copy of the code of conduct and incorporate it into your training programs.
• Account reconciliations. Reconciliations are an essential internal control tool. They help prevent and detect corporate fraud by comparing information in the company’s records to third-party sources, such as bank and credit card statements, loan amortization schedules, aging schedules, and inventory records.

Automating internal controls with SOX compliance software helps ensure they’re consistently followed and streamlines your compliance process.

Task 4: Establish a data governance policy

Although SOX doesn’t go into detail about IT or financial data governance, having a policy for data governance helps companies prevent non-compliance by limiting access to sensitive financial information and ensuring financial data integrity.

Some areas to address in your data governance policy include:

1. How the company detects security breaches
2. Implementing a data loss prevention strategy
3. Protecting sensitive data in real-time, 24/7
4. Prevent data tampering by controlling user logins and establishing role-based data access
5. Ensure you have verifiable data security reporting
6. How you’ll allow SOX auditors access to the data they need to perform the audit
7. How you’ll assess internal controls on an ongoing basis to ensure they’re working as intended and confirm their effectiveness

Task 5: Regularly test controls

SOX compliance requires ongoing vigilance, and one important way to ensure that your internal controls are effective is to test them regularly. Testing helps you catch any problems before they cause serious damage and also helps ensure that your employees follow the established procedures. In addition, periodic testing allows you to make necessary adjustments to your controls and keeps everyone on their toes.

Task 6: Schedule and plan for an external audit

SOX compliance requires an external audit to ensure that companies are following the regulations set forth by the Sarbanes-Oxley Act. While internal controls can handle some aspects of SOX compliance, it’s essential to have an independent party examine your financial records and other reports to verify their accuracy.

Planning for a SOX compliance audit can seem daunting, but the following tips can help:

• Start planning early. The more time you have, the less stressed you’ll be. Schedule your audit at least six months in advance to allow plenty of time for coordination.
• Gather all required documentation. This includes financial statements, accounting records, information about your internal control systems, and other relevant documents.
• Cooperate with the auditor. Be available for meetings and provide requested information promptly. Remember, the auditor is there to help you comply with SOX requirements, not to find fault or place blame.
• Follow up after the audit. Review the findings of the audit and make any necessary changes to your internal controls or procedures.

SOX compliance can seem daunting, but following best practices and using a checklist can make the process much easier. At FloQast, we’ve created a comprehensive SOX compliance checklist to help our clients adhere to the regulations. This checklist covers everything from financial statement auditing to risk assessment and whistleblower protection. We hope you find this resource helpful as you work to ensure SOX compliance.

Stefan van Duyvendijk

Stefan van Duyvendijk is FloQast's first Accounting Operations Evangelist. Stefan is a tenured controller who has consistently nurtured finance professionals and improved accounting processes throughout his career. Previously he was Corporate Controller for Kodiak Cakes where he led a 10-member finance team through a pre-IPO initiative. Before that, he was U.S. Controller for Skullcandy and senior associate at KPMG.