SOC / Attestation
Available nowSOX (Sarbanes-Oxley) Section 404 · Act of 2002 §404; COSO 2013 framework, 17 principles
SOX Section 404 is the obligation on a US issuer’s management to assess whether its internal control over financial reporting is effective, and to say so in the annual report. The Act publishes no control list, so that assessment is made against a recognized control framework — and the one issuers name is the COSO Internal Control—Integrated Framework (2013). That framework is Keel’s scope here, and the whole of it: the five components — control environment, risk assessment, control activities, information and communication, and monitoring activities — and all 17 principles beneath them, each written from the assessment angle of what an issuer has to be able to show. What is not modelled is said out loud rather than left to be discovered: the §302 and §906 officer certifications, the §404(b) auditor attestation, the process-level controls over revenue, procure-to-pay, payroll, the financial close and management estimates, and COSO’s points of focus. Scoring 100% here is an entity-level self-assessment against the principles, not a Section 404 conclusion — Keel is not an auditor and does not issue one.
17
requirements tracked
Premium
Access
Add-on from $49/mo
Scope
How much of the standard Keel models
Keel authors every leaf requirement in the scope declared below — all 17 of them, with nothing inside that scope left out. A test fails the build if the authored count and the declared count ever diverge, so this framework cannot quietly lose requirements after the fact.
- Authored in Keel
- 17 requirements
- In Keel’s scored scope
- 17 leaf requirements
Keel publishes this for every framework it ships, complete or not, so a readiness percentage can be read against a denominator you can see. Compare every framework
Who it is for
Who needs SOX (Sarbanes-Oxley) Section 404?
- Newly public and pre-IPO companies facing management’s first assessment of internal control over financial reporting
- Finance, IT and internal audit teams who own the entity-level half of a 404 program and currently run it out of spreadsheets
- Private companies asked to demonstrate SOX-grade controls by an acquirer, a lender, or an issuer they supply
What Keel does
How Keel helps with SOX (Sarbanes-Oxley) Section 404
- All 17 principles as scored requirements under the five COSO components, each stating what you need to be able to show and the evidence that shows it
- 29 pre-mapped starter controls you can apply in one click, covering 14 of the 17 principles
- The technology general controls Principle 11 asks for — access and recertification, change management, operations, backup and restore — carried by the controls your security framework already needs, so that work is evidenced once instead of twice
- An owner, a status and dated evidence against each principle, so the entity-level assessment is a live record rather than something reconstructed at year end
Collect once, comply everywhere
SOX (Sarbanes-Oxley) Section 404 shares canonical controls with ISO/IEC 27001, SOC 2 and NIST SP 800-53 and others in the catalog. Implement one of those controls and it counts toward every framework it satisfies, so adding SOX (Sarbanes-Oxley) Section 404 rarely means starting from scratch.
Shares canonical controls with
- ISO/IEC 27001
- CIS Critical Security Controls
- PCI DSS
- SOC 2
- NIST Cybersecurity Framework
- NIST SP 800-53
- NIST SP 800-171
- HIPAA
- GDPR
- COPPA
- Google Play Families
- Amazon Appstore Child-Directed Apps
- Apple App Store Kids Category
- ISO 9001
- AI Governance Essentials
- ISO/IEC 42001
- NIST AI Risk Management Framework
- EU AI Act
- ESG Essentials
- US Employment Law - Federal Baseline
Other frameworks: ISO/IEC 27001 · CIS Critical Security Controls · PCI DSS · SOC 2 · NIST Cybersecurity Framework · NIST SP 800-53 · All frameworks