Requirements & evidence
Sarbanes-Oxley ICFR
The US public-company regime for management assessment and, where applicable, independent audit of internal control over financial reporting. SOX does not prescribe one universal IT-control catalog, and registry tracking is not an audit opinion.
- Edition on record
- SOX Sections 302 and 404; PCAOB AS 2201
- Edition published
- Source last checked
Understand the scope
What the framework covers.
The library records this framework for public companies, financial reporting, audit firms, across US. The issuing authority determines applicability; your assessment scope should identify the organization, systems, services, and edition being assessed.
Areas of requirement
- Management assessment of ICFR
- Disclosure controls and procedures
- Integrated audit of ICFR
- Deficiency evaluation and reporting
- IT general controls as scoped to financial reporting
The library tracks the authority and edition. A normalized requirement catalog is not available for this framework, so a requirement count is not stated here.
Prepare with context
The evidence behind
the requirements.
Evidence needs to demonstrate how a requirement is met within the assessment scope. Keep the source requirement, collection context, responsible owner, review decision, and period of applicability together.
A framework-specific collection workflow has not been activated. The reference material on this page can inform scoping and preparation; it does not establish evidence collection or assessment readiness.
ControlFrame availability
Framework reference available
Authority and version facts, with a parsed public catalog when available; no tenant blueprint or executable evidence method is activated.
How availability is determined
Sarbanes-Oxley ICFR is tracked in the registry — authority, version ledger, verification — and nothing else is modelled for it yet. Import its catalog to begin.
Catalog status: Planned. Tracked metadata: we record the regime and its issuing authority for review. Registry presence does not mean automated monitoring is active. No control or requirement model is implemented.
Metadata only; SOX applicability, issuer scoping, ICFR risks and controls, testing, deficiency evaluation, and auditor procedures are not ingested or implemented as a distinct module.
Follow the source
Editions and transitions.
These are the editions recorded in the library, checked August 30, 2026. Confirm the applicable edition with the authority before beginning an assessment.
Announced transition
PCAOB and SEC-approved amendments to AS 2201 paragraph .09 and new paragraph .99 become effective on 2026-12-15. They affect the auditor standard, not the statutory text of SOX.
Authority’s stated timing: 2026-12-15
Read the authority’s announcement (opens in a new tab)- SOX Sections 302 and 404; PCAOB AS 2201Current edition on record
Recorded change history
· Sarbanes-Oxley ICFR: PCAOB and SEC-approved amendments to AS 2201 paragraph .09 and new paragraph .99 become effective on 2026-12-15. They affect the auditor standard, not the statutory text of SOX.
Check the basis
Sources you can follow.
Verified against the issuing authority’s own publication. Source verification was recorded on August 30, 2026.
- U.S. Securities and Exchange Commission — Release 33-8238 (opens in a new tab)
Issuing authority and framework publication.
- Edition reference: SOX Sections 302 and 404; PCAOB AS 2201 (opens in a new tab)
The publication used to establish the recorded edition.
Catalog provenance and record details
Framework record: sox-icfr.
Source artifact: acquisition required.
Parsed catalog: Not ingested.
Control families as published: Management assessment of ICFR · Disclosure controls and procedures · Integrated audit of ICFR · Deficiency evaluation and reporting · IT general controls as scoped to financial reporting.
Record last updated: August 30, 2026.
Common questions
A closer look.
What is Sarbanes-Oxley ICFR?
The US public-company regime for management assessment and, where applicable, independent audit of internal control over financial reporting. SOX does not prescribe one universal IT-control catalog, and registry tracking is not an audit opinion.
Who does Sarbanes-Oxley ICFR apply to?
Sarbanes-Oxley ICFR applies to public companies, financial reporting, audit firms, US, per U.S. Securities and Exchange Commission — Release 33-8238.
What is the current version of Sarbanes-Oxley ICFR?
The current edition is SOX Sections 302 and 404; PCAOB AS 2201, issued by U.S. Securities and Exchange Commission — Release 33-8238 and published 2003-06-05. Source: https://www.sec.gov/rule-release/33-8238.
What does an assessment under Sarbanes-Oxley ICFR require?
No control catalog has been ingested for Sarbanes-Oxley ICFR yet — the registry tracks it as planned (Tracked metadata: we record the regime and its issuing authority for review. Registry presence does not mean automated monitoring is active. No control or requirement model is implemented), so an assessment under this framework currently requires the authority's own catalog rather than a ControlFrame-parsed one.
At a glance
Sarbanes-Oxley ICFR
SOX Sections 302 and 404; PCAOB AS 2201
- Framework reference
- Authority and edition tracked
- Evidence preparation
- Framework reference available
- Source confidence
- Primary authority
A framework reference describes requirements. Evidence decisions belong to a scoped assessment and a named reviewer.
Make the requirements
part of the work.
Explore how ControlFrame can organize Sarbanes-Oxley ICFR requirements, evidence preparation, and review for your assessment scope.