Step 1 of 7: Identity
Sarbanes-Oxley (SOX)
Deficiencies, fraud risk & disclosure link CoreA test found an exception and it must be classified and remediated.
The "SOX Deficiency Evaluation" workflow has 7 steps, in this order: Step 1 Identity, Step 2 Classification, Step 3 Severity, Step 4 Mitigation, Step 5 Aggregation, Step 6 Narrative, Step 7 Audit. Steps must be completed in order; each unlocks the next.
Sarbanes-Oxley Act Sections 302/404/906; PCAOB AS 2201; COSO 2013
7 steps, completed in order. Each step is validated against the schema before the next unlocks.
Step 1 of 7
ScreenSarbanes-Oxley (SOX)step 1
Complete the Identity fields. Each value is validated against the schema before the next step unlocks.
Domain entity ID (required)
entityIdThe organisation or system this record is about — lowercase with dashes, e.g. acme-corp-hq. Pick one you have used before, or type a new id to create it.
Control affected (required)
controlIdEnter control affected.
Step 2 of 7
ScreenSarbanes-Oxley (SOX)step 2
Complete the Classification fields. Each value is validated against the schema before the next step unlocks.
Nature (required)
deficiencyNatureEnter nature.
Origin (required)
originWhere the deficiency came from. Self-identified versus auditor-identified is a real health measure of the programme.
Source incidentoptional
sourceIncidentIdRequired for a cybersecurity-origin deficiency — the link runs through the control that was degraded, not through the word cyber.
Step 3 of 7
ScreenSarbanes-Oxley (SOX)step 3
Complete the Severity fields. Each value is validated against the schema before the next step unlocks.
Potential misstatement (minor units) (required)
magnitudeMinorWhat the deficiency could allow, not what it did allow.
Materiality (minor units) (required)
materialityMinorFrom the scope position. Magnitude is judged against this.
Likelihood (required)
likelihoodReasonable possibility is a LOWER bar than probable, and is the statutory test.
Severity (required)
severityEnter severity.
Severity at identification (required)
originalSeverityImmutable. A remediated material weakness was still a material weakness during the period.
Classification rationaleoptional
severityRationaleEnter classification rationale.
Step 4 of 7
ScreenSarbanes-Oxley (SOX)step 4
Complete the Mitigation fields. Each value is validated against the schema before the next step unlocks.
Compensating controloptional
compensatingControlIdEnter compensating control.
Compensating control has been testedoptional
compensatingControlTestedAn untested compensating control is an argument, not a mitigation.
Step 5 of 7
ScreenSarbanes-Oxley (SOX)step 5
Complete the Aggregation fields. Each value is validated against the schema before the next step unlocks.
Aggregation basisoptional
aggregationBasisIndividually minor deficiencies over the same account can be material in combination.
Aggregation groupoptional
aggregationGroupIdEnter aggregation group.
Step 6 of 7
ScreenSarbanes-Oxley (SOX)step 6
Complete the Narrative fields. Each value is validated against the schema before the next step unlocks.
Description (required)
descriptionEnter description.
Root causeoptional
rootCauseDistinct from the description. "Reconciliation not performed" is a description; "no backup preparer" is a root cause. Remediation addresses the second.
Step 7 of 7
ScreenSarbanes-Oxley (SOX)step 7
No manual input is captured here: this step is completed from the preceding sections or by the platform.
No manual inputs in this step.
Continue with the next guide in this framework's table of contents.
The "SOX Disclosure Readiness Link" workflow has 7 steps, in this order: Step 1 Identity, Step 2 Link, Step 3 Condition, Step 4 Determination, Step 5 Clocks, Step 6 Reporting, Step 7 Audit. Steps must be completed in order; each unlocks the next.
Read guide Deficiencies, fraud risk & disclosure linkThe "SOX Fraud Risk Assessment" workflow has 8 steps, in this order: Step 1 Identity, Step 2 Classification, Step 3 Triangle, Step 4 Controls, Step 5 Reassessment, Step 6 Incident, Step 7 History, Step 8 Audit. Steps must be completed in order; each unlocks the next.
Read guide Program scope & control inventoryThe "SOX ICFR Scope" workflow has 7 steps, in this order: Step 1 Identity, Step 2 Materiality, Step 3 Scope, Step 4 Exclusions, Step 5 Changes, Step 6 Framework, Step 7 Audit. Steps must be completed in order; each unlocks the next.
Read guide