SOX audit: how the process works and how to prepare your team

The average SOX program now runs 546 key controls across 15,580 hours at a cost of $2.3 million, according to KPMG's 2025 SOX Survey. Key control counts rose 18% in two years while the automated share of controls fell from 21% to 17%. More controls, tested more manually, inside the same audit calendar.

PCAOB QC 1000 takes effect on December 15, 2026, raising the quality control bar for the firms performing the attestation. This guide covers what a SOX audit actually involves, what external auditors do under AS 2201, where internal audit fits, what auditors look for, and how to prepare without a year-end scramble.

What a SOX audit covers

A SOX audit tests whether the controls producing a company's financial statements were designed appropriately and operated effectively throughout the fiscal year. Two distinct exercises sit under the label.

Management's assessment under Section 404(a) is performed internally, usually by a SOX team inside finance or internal audit. Every SEC reporting company owes it.

The external auditor's attestation under Section 404(b) is an independent opinion on control effectiveness, issued alongside the financial statement opinion in the Form 10-K. Only accelerated and large accelerated filers owe it, and the SOX 404 article sets out the filer thresholds.

The second exercise is what practitioners mean by "the SOX audit." It is not a separate engagement. AS 2201 requires the auditor to integrate the audit of internal control with the audit of the financial statements, using one set of procedures to support both opinions. For how Section 404 sits alongside the other SOX provisions, see the SOX compliance guide.

The SOX external audit process under PCAOB AS 2201

AS 2201 prescribes a top-down, risk-based approach that works from the financial statements downward, leaving auditors to build the procedures rather than follow a checklist. In practice the engagement runs in five stages.

1. Planning. The auditor builds an understanding of the business and its risks, assesses fraud risk, and decides how far to rely on the work of internal audit and management.
2. Top-down scoping. The auditor starts at the financial statement level, evaluates entity-level controls, identifies significant accounts and disclosures with their relevant assertions, works out the likely sources of misstatement, and selects the controls that address them. Strong entity-level controls can reduce testing further down.
3. Testing design effectiveness. Usually a walkthrough, tracing one transaction end to end. The question is whether the control, operating as described, would catch the misstatement it exists to catch.
4. Testing operating effectiveness. The auditor samples from the full population of control executions across the period and inspects evidence that each one actually ran. Treating a walkthrough as a substitute for this step is itself a methodology deficiency.
5. Evaluating deficiencies and forming the opinion. Exceptions get classified as control deficiencies, significant deficiencies, or material weaknesses, individually and in aggregate. One material weakness at year-end produces an adverse opinion on ICFR.

Stage 4 can reopen stage 2. An exception in a control the auditor planned to rely on expands sample sizes, brings compensating controls into scope, or both.

What external auditors test

Three layers, in the order AS 2201 works through them.

Entity-level controls operate organization-wide: the control environment, board and audit committee oversight, the fraud risk program, and period-end financial reporting controls. Auditors test these first because the result shapes everything below.

Process-level controls sit inside a cycle such as procure-to-pay or order-to-cash and address assertion-level risks like completeness, accuracy, and cutoff. Three-way match, approval thresholds, account reconciliations.

IT general controls cover access, change management, and IT operations across the systems producing financial data. Every automated control depends on them, so a broken ITGC can invalidate the application controls sitting on top of it. The IT internal controls article covers the scope question in detail.

Sample size follows control frequency and assessed risk. The figures below reflect the convention applied across Big Four methodologies. They are practice, not a requirement in AS 2201, and firms diverge most on high-frequency controls.

Two practical notes. External auditors expect management's samples to be at least as large as their own, so aligning sizes early avoids retesting. And for high-frequency controls with large populations, testing the entire population removes sampling risk instead of managing it.

The internal audit's role

AS 2201 allows the auditor to use the work of others, which makes internal audit's contribution directly measurable in audit fees. The scope of that reliance depends on the competence and objectivity of the people performing the work, and on the auditor's own assessment of it.

Two findings from KPMG's 2025 survey describe how this plays out. Over half of organizations, 56%, reported that their external auditor had fewer in-scope controls than they did, so part of the internal testing burden exceeds what the attestation requires. And 90% could not quantify the fee savings generated by auditor reliance on their work, which makes the extra testing hard to justify in a budget conversation.

Audit management tooling is covered in the internal audit software comparison.

What's changing in 2026

PCAOB QC 1000 takes effect on December 15, 2026. It requires registered firms to design, implement, and operate a risk-based quality control system, and to evaluate and report on that system to the Board annually. Amendments to AS 2201 and AS 2101 take effect the same day, formalizing the top-down scoping approach around entity-level controls.

The consequence for issuers is indirect and predictable. A firm held to a tighter quality control standard passes the evidence burden along, and documentation demands on finance teams typically climb in the audit cycles immediately after a standards change.

A dedicated SEC enforcement unit now sits behind the standards. On August 5, 2026 the SEC established a Financial Reporting and Accounting Unit inside its Division of Enforcement, staffed with attorneys and accountants and dedicated to accounting, financial reporting, and auditing misconduct. It is the first specialized unit in the division's modern structure devoted solely to this area.

Both changes point the same way: more scrutiny of the audit firm, and through it, more scrutiny of the evidence the company hands over.

What auditors look for, and where organizations fall short

Auditors are looking above all for evidence that a control ran, on identifiable items, with a documented outcome. Most findings trace back to that evidence being thin.

KPMG's study of material weaknesses disclosed in fiscal 2025, drawing on Audit Analytics data, found 238 public companies reporting one. The recurring themes are specific.

• Imprecise management review controls. The most frequently cited financial close issue. A reviewer signs off without documenting what was reviewed, against what threshold, and what happened to the items that failed it.
• Journal entry review. Weak evidence that entries were examined before posting, particularly manual and top-side entries.
• Information produced by the entity. Reports feeding a control with no evidence that their completeness and accuracy were verified.
• User access management. The leading ITGC theme: excessive privileges, terminated users left active, access reviews performed late or superficially.
• Segregation of duties. Enforced in a procedure note instead of in the system.

The pattern underneath is consistent. Controls that depend on someone remembering to document a review produce contested evidence. Controls that generate a record as a by-product of running do not.

How to prepare for a SOX audit

Preparation that starts at year-end has already failed, because the assessment covers the whole fiscal year. A control gap found in December cannot be remediated inside the period it affected.

Test in two phases. 63% of organizations performed tests of operating effectiveness in two phases in FY24: an interim phase, then a roll-forward covering the remaining period. Splitting the year this way is what creates a remediation window at all.

Run a dry run roughly 90 days before year-end. This is the practical deadline, and the reason is arithmetic. A control that fails needs to be fixed, then operate long enough to generate a testable population before the fiscal year closes. A monthly control found broken in October can produce two or three clean occurrences by December. The same control found broken in December cannot.

Size samples with the auditor, not after. 57% of organizations modified sample sizes and testing procedures based on control risk. Agreeing the approach with the external audit team before testing begins avoids the most expensive outcome, which is retesting a population the auditor declines to accept.

Make evidence a by-product. Continuous controls monitoring runs control tests on every data extraction across the full transaction population. Exceptions surface within days, and the record of each test accumulates without anyone assembling it.

That last point connects directly to audit cost. Auditor reliance on management's work depends on the quality of the evidence behind it. Full-population testing with a reproducible trail gives the external auditor a stronger basis for reliance than a sample assembled manually, which reduces auditor-performed testing. Supervizor's compliance solution applies this across procure-to-pay, order-to-cash, and record-to-report, and the underlying ICFR assessment process is covered separately.

What happens if you fail

Failure in a SOX audit means an adverse opinion on internal control over financial reporting, triggered by one or more material weaknesses at year-end. The financial statement opinion can still be unqualified; the two are separate.

The consequences run in sequence. The material weakness is disclosed in the 10-K with management's remediation plan. Audit fees rise, because the auditor expands testing in the affected area. Lenders and rating agencies read the disclosure. Proxy advisors may recommend against audit committee members when a weakness persists without a credible remediation plan.

Restatement is the more serious branch. The Center for Audit Quality found that 97% of ICFR reports issued within a year of a material restatement disclosed at least one material weakness. A weakness is not a restatement, but the two travel together often enough that investors read the first as a signal about the second.

Remediation requires the control to be redesigned, implemented, and operated long enough to be tested again. That usually means the weakness carries into at least one more reporting period.

Conclusion

The SOX audit rewards evidence produced as work happens and punishes evidence assembled after the fact. The preparation calendar decides which one a company brings to the engagement, because a control that fails in December cannot be remediated inside the period it affected. The pressure is measurable: key controls rose 18% to 546 between FY22 and FY24 while the automated share of controls fell from 21% to 17%.