SOX (Sarbanes-Oxley) Section 404 · Act of 2002 §404; COSO 2013 framework

SOX Section 404 is the obligation on a US issuer’s management to assess whether its internal control over financial reporting is effective, and to say so in the annual report. The Act publishes no control list, so that assessment is made against a recognized control framework, and the one issuers name is the COSO Internal Control—Integrated Framework (2013). That framework is Keel’s scope here, and the whole of it: the components (control environment, risk assessment, control activities, information and communication, and monitoring activities) and every principle beneath them, each written from the assessment angle of what an issuer has to be able to show. What is not modelled is said out loud rather than left to be discovered: the §302 and §906 officer certifications, the §404(b) auditor attestation, the process-level controls over revenue, procure-to-pay, payroll, the financial close and management estimates, and COSO’s points of focus. Scoring 100% here is an entity-level self-assessment against the principles, not a Section 404 conclusion. Keel is not an auditor and does not issue one.

Premium

Access

Add-on from $49/mo

Important

This is an entity-level self-assessment against the COSO 2013 principle set, not a Section 404 conclusion. Scoring 100% here means an implemented control is mapped to each of the COSO principles; it is NOT a determination that internal control over financial reporting is effective, and it does not cover the process-level controls over revenue, procure-to-pay, payroll, the financial close and management estimates that a real 404 assessment scopes and tests, COSO’s points of focus, or the §302 and §906 officer certifications. Note who is subject to what: §404(a) — management’s own assessment — applies to every issuer, while the §404(b) auditor attestation is exempted for issuers that are neither large accelerated nor accelerated filers (15 U.S.C. 7262(c)) and for emerging growth companies. Keel’s summaries are paraphrase, not legal or accounting advice; if you are an SEC registrant, scope your assessment with your auditors.

Start your 14-day free Pro trial with SOX (Sarbanes-Oxley) Section 404 See pricing

Scope

How much of the standard Keel models

Models its declared scope in full

Keel authors every leaf requirement in the scope declared below, with nothing inside that scope left out. A test fails the build if the authored count and the declared count ever diverge, so this framework cannot quietly lose requirements after the fact.

Authored in Keel: Every requirement in the declared scope
In Keel’s scored scope: The same set Keel authors

Keel publishes this for every framework it ships, complete or not, so a readiness percentage can be read against a denominator you can see. Compare every framework

Who it is for

Who needs SOX (Sarbanes-Oxley) Section 404?

Newly public and pre-IPO companies facing management’s first assessment of internal control over financial reporting
Finance, IT and internal audit teams who own the entity-level half of a 404 program and currently run it out of spreadsheets
Private companies asked to demonstrate SOX-grade controls by an acquirer, a lender, or an issuer they supply

What Keel does

How Keel helps with SOX (Sarbanes-Oxley) Section 404

Every principle as a scored requirement under the COSO components, each stating what you need to be able to show and the evidence that shows it
25+ pre-mapped starter controls you can apply in one click, with every principle carrying at least one
The technology general controls Principle 11 asks for (access and recertification, change management, operations, backup and restore), carried by the controls your security framework already needs, so that work is evidenced once instead of twice
An owner, a status and dated evidence against each principle, so the entity-level assessment is a live record rather than something reconstructed at year end

Collect once, comply everywhere

SOX (Sarbanes-Oxley) Section 404 shares canonical controls with SOC 2, ISO/IEC 27001 and NIST SP 800-53 and others in the catalog. Implement one of those controls and it counts toward every framework it satisfies, so adding SOX (Sarbanes-Oxley) Section 404 rarely means starting from scratch.

Shares canonical controls with

ISO/IEC 27001 shares canonical controls
CIS Critical Security Controls shares canonical controls
PCI DSS shares canonical controls
SOC 2 shares canonical controls
NIST Cybersecurity Framework shares canonical controls
NIST SP 800-53 shares canonical controls
FedRAMP Rev5 Class B shares canonical controls
FedRAMP Rev5 Class C shares canonical controls
FedRAMP Rev5 Class D shares canonical controls
FedRAMP 20x shares canonical controls
FedRAMP Consolidated Rules shares canonical controls
NIST SP 800-171 shares canonical controls
HIPAA shares canonical controls
GDPR shares canonical controls
COPPA shares canonical controls
Google Play Families no shared canonical controls
Amazon Appstore Child-Directed Apps no shared canonical controls
Apple App Store Kids Category no shared canonical controls
PIPEDA shares canonical controls
ISO 9001 shares canonical controls
AI Governance Essentials shares canonical controls
ISO/IEC 42001 shares canonical controls
NIST AI Risk Management Framework no shared canonical controls
EU AI Act no shared canonical controls
ESG Essentials shares canonical controls
US Employment Law - Federal Baseline shares canonical controls

A framework is lit when at least one canonical control satisfies both SOX (Sarbanes-Oxley) Section 404 and that framework. Unlit means none of them do, which is an absence rather than a judgment about that standard.

Questions about SOX (Sarbanes-Oxley) Section 404 in Keel

What is SOX 404?

Section 404 of the Sarbanes-Oxley Act of 2002 deals with internal control over financial reporting (ICFR). Under Item 308 of Regulation S-K, management’s annual report has to state that management is responsible for ICFR, name the framework it used to evaluate it, and say whether ICFR was effective at fiscal year end. That report must disclose any material weakness management found, and management may not conclude that ICFR is effective while one exists.

What is the difference between SOX 404(a) and 404(b)?

Section 404(a) is management’s own assessment, and every reporting issuer other than a registered investment company or an asset-backed issuer makes it from its second annual report onward. Section 404(b) adds an attestation report on ICFR from the registered public accounting firm that audits the financial statements. Emerging growth companies are exempt from 404(b), and so are issuers that are neither accelerated nor large accelerated filers. Under SEC Rule 12b-2, an accelerated filer generally has a public float of $75 million or more but under $700 million, and a large accelerated filer $700 million or more, both measured on the last business day of the second fiscal quarter. The rule adds conditions on reporting history and a revenue test for smaller reporting companies, so confirm your status with counsel or your auditor. Keel works on the 404(a) side. It does not model the 404(b) attestation and does not issue one.

What is a material weakness under SOX?

SEC rules define a material weakness as a deficiency, or a combination of deficiencies, in ICFR such that there is a reasonable possibility that a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis. A significant deficiency is less severe but still important enough to merit the attention of those overseeing financial reporting. Keel does not classify deficiencies for you; that judgement belongs to management and the auditor.

Where does Keel fit in a SOX 404 compliance program?

Keel holds the entity-level half of the assessment. Each COSO 2013 principle is a scored requirement with an owner, a status and dated evidence. The IT general controls under Principle 11 map to the same starter controls as your security framework, so access control and change management are evidenced once. The process-level controls over revenue, procure-to-pay, payroll, the financial close and management estimates are outside Keel’s SOX scope, and so are the officer certifications under §302 and §906.

Other frameworks: ISO/IEC 27001 · CIS Critical Security Controls · PCI DSS · SOC 2 · NIST Cybersecurity Framework · NIST SP 800-53 · All frameworks