Step 1 of 7: Identity
Sarbanes-Oxley (SOX)
Program scope & control inventoryThe "SOX ITGC Scope" workflow has 7 steps, in this order: Step 1 Identity, Step 2 Scope, Step 3 Dependency, Step 4 Cyber, Step 5 Determination, Step 6 Access, Step 7 Audit. Steps must be completed in order; each unlocks the next.
Sarbanes-Oxley Act Sections 302/404/906; PCAOB AS 2201; COSO 2013
7 steps, completed in order. Each step is validated against the schema before the next unlocks.
Step 1 of 7
ScreenSarbanes-Oxley (SOX)step 1
Complete the Identity fields. Each value is validated against the schema before the next step unlocks.
Domain entity ID (required)
entityIdThe organisation or system this record is about — lowercase with dashes, e.g. acme-corp-hq. Pick one you have used before, or type a new id to create it.
System (required)
systemIdEnter system.
Step 2 of 7
ScreenSarbanes-Oxley (SOX)step 2
Complete the Scope fields. Each value is validated against the schema before the next step unlocks.
Financial relevance (required)
financialRelevanceEnter financial relevance.
Significant accounts depending on this system (required)
supportedAccountIdsEnter significant accounts depending on this system.
ITGC domainoptional
itgcDomainEnter itgc domain.
Step 3 of 7
ScreenSarbanes-Oxley (SOX)step 3
Complete the Dependency fields. Each value is validated against the schema before the next step unlocks.
Controls depending on this system (required)
dependentControlIdsEnter controls depending on this system.
Dependency kindoptional
dependencyKindEnter dependency kind.
ITGCs over this system assessed effectiveoptional
itgcIsEffectiveEnter itgcs over this system assessed effective.
Step 4 of 7
ScreenSarbanes-Oxley (SOX)step 4
Complete the Cyber fields. Each value is validated against the schema before the next step unlocks.
Source incidentoptional
sourceIncidentId§4.4 — the incident belongs to the security side, the deficiency to ICFR. They reference each other; neither contains the other.
Control that was degradedoptional
degradedControlIdThe first of §4.3's three things. Without it there is an incident, not an ICFR finding.
Evidence of the degradationoptional
degradationEvidenceIdThe second. An assertion that a control was affected is not evidence that it was.
Deficiency raisedoptional
raisedDeficiencyIdEnter deficiency raised.
Step 5 of 7
ScreenSarbanes-Oxley (SOX)step 5
Complete the Determination fields. Each value is validated against the schema before the next step unlocks.
Determination made byoptional
determinationMadeByEnter determination made by.
Determination reasoningoptional
determinationReasoning"This incident did not affect a financially-relevant control" is a conclusion an auditor may ask about — particularly for a publicly-disclosed incident.
Determined onoptional
determinedOnEnter determined on.
Step 6 of 7
ScreenSarbanes-Oxley (SOX)step 6
Complete the Access fields. Each value is validated against the schema before the next step unlocks.
Emergency or privileged access was grantedoptional
emergencyAccessGrantedEnter emergency or privileged access was granted.
Emergency access stateoptional
emergencyAccessStateEnter emergency access state.
Approved byoptional
emergencyAccessApprovedByEnter approved by.
After-the-fact review onoptional
emergencyAccessReviewedOnEnter after-the-fact review on.
Step 7 of 7
ScreenSarbanes-Oxley (SOX)step 7
No manual input is captured here: this step is completed from the preceding sections or by the platform.
No manual inputs in this step.
Continue with the next guide in this framework's table of contents.
The "SOX ICFR Scope" workflow has 7 steps, in this order: Step 1 Identity, Step 2 Materiality, Step 3 Scope, Step 4 Exclusions, Step 5 Changes, Step 6 Framework, Step 7 Audit. Steps must be completed in order; each unlocks the next.
Read guide Program scope & control inventoryThe "Internal Controls" workflow has 7 steps, in this order: Step 1 Identity, Step 2 Hierarchy, Step 3 Design, Step 4 IT Dependency, Step 5 Design Period, Step 6 Assertions, Step 7 Audit. Steps must be completed in order; each unlocks the next.
Read guide Program scope & control inventoryThe "SOX Multi-Entity Operations" workflow has 7 steps, in this order: Step 1 Identity, Step 2 Shared Service, Step 3 Standardisation, Step 4 Coverage, Step 5 Consolidation, Step 6 Obligations, Step 7 Audit. Steps must be completed in order; each unlocks the next.
Read guide