Why SOX 404 matters to internal audit and controllers
Section 404(a) requires management to assess ICFR each year and report its conclusion in the annual report. Section 404(b) requires the external auditor's own opinion for accelerated and large accelerated filers.
The external auditor follows PCAOB AS 2201. Section 302 adds quarterly certifications by the CEO and CFO.
Most companies use the COSO 2013 framework. They pick key controls for each significant account, test design and operation, then grade any deficiencies. A material weakness must be disclosed.
The same controls are tested every year against a fixed deadline, which suits tests that are saved and re-run.
An example
A key control says the controller approves manual journals above a set amount. Each quarter, the team pulls every manual journal above that amount. It checks each one for approval before posting, by someone other than the preparer.
How IRAME handles it
IRAME runs AI-led SOX testing for controllers and internal audit. IRA, IRAME's AI auditor, saves each control and re-runs it on the full population where the data allows, proposing a documented sample where the auditor needs one. Every result carries evidence your external auditor can re-perform.