Step 1 of 8: Identity
Sarbanes-Oxley (SOX)
Deficiencies, fraud risk & disclosure linkThe "SOX Fraud Risk Assessment" workflow has 8 steps, in this order: Step 1 Identity, Step 2 Classification, Step 3 Triangle, Step 4 Controls, Step 5 Reassessment, Step 6 Incident, Step 7 History, Step 8 Audit. Steps must be completed in order; each unlocks the next.
Sarbanes-Oxley Act Sections 302/404/906; PCAOB AS 2201; COSO 2013
8 steps, completed in order. Each step is validated against the schema before the next unlocks.
Step 1 of 8
ScreenSarbanes-Oxley (SOX)step 1
Complete the Identity fields. Each value is validated against the schema before the next step unlocks.
Domain entity ID (required)
entityIdThe organisation or system this record is about — lowercase with dashes, e.g. acme-corp-hq. Pick one you have used before, or type a new id to create it.
Fraud risk (required)
riskIdEnter fraud risk.
Risk description (required)
riskDescriptionEnter risk description.
Step 2 of 8
ScreenSarbanes-Oxley (SOX)step 2
Complete the Classification fields. Each value is validated against the schema before the next step unlocks.
Level (required)
riskLevelTransaction-level scenarios are legitimate detail beneath entity-level risks, never a substitute for them.
Category (required)
riskCategoryEnter category.
Entity-level risk this sits beneathoptional
parentRiskIdEnter entity-level risk this sits beneath.
This is the standing management-override riskoptional
isManagementOverrideSeeded, not created. It can be addressed but never removed — the ability of management to override controls is a property of having management.
Step 3 of 8
ScreenSarbanes-Oxley (SOX)step 3
Complete the Triangle fields. Each value is validated against the schema before the next step unlocks.
Triangle conditions present (required)
triangleConditionsEnter triangle conditions present.
Incentive / pressureoptional
incentiveNarrativeEnter incentive / pressure.
Opportunityoptional
opportunityNarrativeEnter opportunity.
Rationalizationoptional
rationalizationNarrativeEnter rationalization.
Step 4 of 8
ScreenSarbanes-Oxley (SOX)step 4
Complete the Controls fields. Each value is validated against the schema before the next step unlocks.
Anti-fraud controls addressing this risk (required)
antiFraudControlIdsEnter anti-fraud controls addressing this risk.
Linked controls tested effective underoptional
controlsTestedEffectiveEnter linked controls tested effective under.
Deficiency raised for an ineffective anti-fraud controloptional
ineffectiveControlDeficiencyIdEnter deficiency raised for an ineffective anti-fraud control.
Step 5 of 8
ScreenSarbanes-Oxley (SOX)step 5
Complete the Reassessment fields. Each value is validated against the schema before the next step unlocks.
Last assessed on (required)
lastAssessedOnEnter last assessed on.
Next scheduled review (required)
reassessmentDueOnEnter next scheduled review.
Triggers fired since the last assessment (required)
activeTriggersEnter triggers fired since the last assessment.
Step 6 of 8
ScreenSarbanes-Oxley (SOX)step 6
Complete the Incident fields. Each value is validated against the schema before the next step unlocks.
A fraud incident is recorded against this riskoptional
incidentRecordedEnter a fraud incident is recorded against this risk.
Who was involvedoptional
incidentInvolvementEnter who was involved.
Amount (minor units)optional
incidentAmountMinorRecorded for information. It does NOT gate the 302 obligation — that has no materiality threshold for management or significant-ICFR-role involvement.
Triggers a Section 302 fraud disclosureoptional
triggers302DisclosureEnter triggers a section 302 fraud disclosure.
Step 7 of 8
ScreenSarbanes-Oxley (SOX)step 7
Complete the History fields. Each value is validated against the schema before the next step unlocks.
Corresponding risk in the prior yearoptional
priorYearRiskIdYear-over-year comparison shows what was added, removed and re-rated. A risk quietly dropped between years is visible.
Step 8 of 8
ScreenSarbanes-Oxley (SOX)step 8
No manual input is captured here: this step is completed from the preceding sections or by the platform.
No manual inputs in this step.
Continue with the next guide in this framework's table of contents.
The "SOX Deficiency Evaluation" workflow has 7 steps, in this order: Step 1 Identity, Step 2 Classification, Step 3 Severity, Step 4 Mitigation, Step 5 Aggregation, Step 6 Narrative, Step 7 Audit. Steps must be completed in order; each unlocks the next.
Read guide Deficiencies, fraud risk & disclosure linkThe "SOX Disclosure Readiness Link" workflow has 7 steps, in this order: Step 1 Identity, Step 2 Link, Step 3 Condition, Step 4 Determination, Step 5 Clocks, Step 6 Reporting, Step 7 Audit. Steps must be completed in order; each unlocks the next.
Read guide Program scope & control inventoryThe "SOX ICFR Scope" workflow has 7 steps, in this order: Step 1 Identity, Step 2 Materiality, Step 3 Scope, Step 4 Exclusions, Step 5 Changes, Step 6 Framework, Step 7 Audit. Steps must be completed in order; each unlocks the next.
Read guide