Stage 2: Lead the enterprise · Module 12 of 15

Controls over financial reporting and SOX

Understand internal control over financial reporting, what the Sarbanes-Oxley Act asks of a CEO and CFO, how control problems are graded, and why tone at the top is the most important control.

How this module works: read the lesson, try the scenario, reflect, then do the activity.

3 lessons · sign in to track progress

The lesson

Part 1

Controls over financial reporting, in plain language

Internal control over financial reporting (ICFR) gives reasonable assurance that the financial statements are reliable. Most US companies design it around the COSO Internal Control framework.

COSO's five components: the control environment (tone at the top), risk assessment, control activities, information and communication, and monitoring.
Controls are preventive (stop the error) or detective (find it), manual or automated. Automated controls are only as good as the IT general controls behind them: access, change management and operations.
Key areas: revenue, purchasing and payments, payroll, inventory, the financial close and journal entries, and management's estimates.
Private companies benefit too: lenders, investors and buyers increasingly expect reliable controls and audited statements.

Takeaway. Reliable numbers come from designed controls, not heroic accountants.

Part 2

What SOX asks of a public-company CEO

The Sarbanes-Oxley Act of 2002 (SOX) made the CEO and CFO of US public companies personally responsible for financial reports and the controls behind them.

Section 302: the CEO and CFO certify each quarterly and annual report — that they reviewed it, it is not misleading, and they are responsible for disclosure controls and internal control, including telling the auditors and audit committee about significant problems.
Section 906: a separate certification with criminal penalties for knowingly or wilfully certifying a report that does not comply.
Section 404(a): management assesses and reports on ICFR every year. Section 404(b): the outside auditor also attests — required for larger (accelerated) filers; smaller non-accelerated filers and emerging growth companies are generally exempt.
Newly public companies generally include the first 404 report in their second annual report — but the controls need to work well before that.

Takeaway. Your signature is on the numbers. Build the system that makes it safe to sign.

Part 3

Deficiencies, material weaknesses and tone at the top

Control problems are graded. A material weakness — a reasonable possibility that a material misstatement will not be prevented or caught in time — must be disclosed publicly and can shake investor and lender confidence.

The grades: control deficiency → significant deficiency (reported to the audit committee) → material weakness (disclosed in public filings).
Common causes: too few skilled accounting staff, weak IT access controls, poor review of estimates, and spreadsheets nobody checks.
Management override is the risk controls can't fully stop — which is why tone at the top, a whistleblower hotline and an independent audit committee matter.
Remediate with owners and dates, and test that fixes actually work before calling them done.

Takeaway. Tone at the top is a control — the most important one.

Which best describes you?

This only changes which examples and suggested modules you see — every lesson stays open to everyone. Your choice is kept on this device.

Illustrative scenario · Promoted inside an organization

Signing your first certification

A COO becomes CEO of a public company six weeks before quarter end. The CFO mentions that a new billing system went live without an access review.

Think it through: What would you need to know before signing the Section 302 certification?

A composite example for learning — not a real case, client or result.

Reflect

If an auditor tested your three most important financial processes tomorrow, which control would fail first?

Jot your answer somewhere private, or talk it through with Monet below.

Activity: Walk one process end to end

Choose revenue or purchase-to-pay.
Write the steps from the first transaction to the general ledger.
Mark what could go wrong at each step.
Name the control, its owner and the evidence it leaves.
List the systems involved and who can change them.

Use it on screen in the Operator Toolkit (members):

Work through specifics with qualified professionals

SOX, SEC and auditing rules are detailed and change over time. Your auditors, CFO and securities counsel confirm what applies to your company. This is general education, not legal, accounting, securities or investment advice.

Ask Monet about this module

Tap a question to open Monet with it ready to edit. Educational guidance only — not tax, legal or investment advice.

Educational guidance, not personal advice. Outputs are illustrative, may contain errors, and should be independently verified before material decisions.