Sarbanes-Oxley ICFR
The US public-company regime for management assessment and, where applicable, independent audit of internal control over financial reporting. SOX does not prescribe one universal IT-control catalog, and registry tracking is not an audit opinion.
SOX Sections 302 and 404; PCAOB AS 2201 · U.S. Securities and Exchange Commission — Release 33-8238 · published 2003-06-05
00Answer
01Standing
Authority and version facts, with a parsed public catalog when available; no tenant blueprint or executable evidence method is activated.
Sarbanes-Oxley ICFR is tracked in the registry — authority, version ledger, verification — and nothing else is modelled for it yet. Import its catalog to begin.
Metadata only; SOX applicability, issuer scoping, ICFR risks and controls, testing, deficiency evaluation, and auditor procedures are not ingested or implemented as a distinct module.
02Registry record
- Registry status
- Planned · namedTracked metadata: we name the regime and monitor its issuing authority. No control or requirement model is implemented.
- Control units
- Not on record — no catalog ingested and no authority-published count cited.
- Control families
- Management assessment of ICFR · Disclosure controls and procedures · Integrated audit of ICFR · Deficiency evaluation and reporting · IT general controls as scoped to financial reporting
- Applies to
- public companies · financial reporting · audit firms · US
- Verification
- Primary — the issuing body's own page was read and states this version. checked 2026-08-30
- Pending change
- PCAOB and SEC-approved amendments to AS 2201 paragraph .09 and new paragraph .99 become effective on 2026-12-15. They affect the auditor standard, not the statutory text of SOX.Expected: 2026-12-15
03Version ledger
| SOX Sections 302 and 404; PCAOB AS 2201 | Current edition | 2003-06-05 |
05Change history
06Related frameworks
- COBIT 2019 (SOX ITGC reference)COBIT 2019
Also applies to public companies · SOX requires management and auditor assessment of internal control over financial reporting but does not prescribe one IT-control catalog. COBIT 2019 is licensed governance guidance often used to design and map IT general controls; neither this record nor COBIT is a SOX certification.
Also applies to public companies · The widely used internal-control framework for operations, reporting, and compliance, including internal control over financial reporting. It supplies evaluation criteria; it is not a certification and SOX does not create a fixed IT-control catalog.
- SEC Cybersecurity Disclosure RulesRelease Nos. 33-11216; 34-97989
Also applies to public companies · What a public company must tell investors: a material cybersecurity incident on Form 8-K Item 1.05 within four business days, and its risk-management and board oversight annually under Reg S-K Item 106.
- GAO Yellow Book (GAGAS)2024 Revision
Commonly assessed together · Generally accepted government auditing standards for financial audits, attestation engagements, reviews, and performance audits. They govern auditor and audit-organization quality; they do not certify the entity being audited.