# SOX: US Sarbanes-Oxley Act (Sections 302 and 404)

> Internal control over financial reporting requirements for companies listed in the US.

URL: https://securei3.com/standards/sox/
Category: Global & regional laws: Law or regulation
Provider: Secure iQube (independent consultancy; ISO certificates are issued by accredited certification bodies; SOC and ISAE reports by licensed CPA and audit firms, which Secure iQube can arrange through partner firms)


The Sarbanes-Oxley Act requires management of US-listed companies to assess and report on internal control over financial reporting, with auditor attestation for larger filers. Service organisations support their clients’ SOX compliance through SOC 1 reports.

We document processes and controls, test effectiveness and strengthen IT general controls.

## Who it is for

- US-listed companies and their subsidiaries worldwide
- Service organisations supporting SOX clients

## Benefits

- Clean ICFR assessments
- Strong IT general controls

## How Secure iQube helps

1. **Applicability and scoping**: Confirm whether and how the law applies to you, entities, data, systems, roles and territories.
2. **Data and process mapping**: Build a record of processing or control inventory so obligations can be tied to real systems and owners.
3. **Gap assessment**: Measure current practice against each obligation and rank the gaps by legal and business risk.
4. **Remediation roadmap**: Policies, notices, contracts, technical controls and governance, sequenced so the highest risks close first.
5. **Evidence and ongoing monitoring**: A compliance calendar, metrics and periodic reviews so you can demonstrate compliance to a regulator or customer at any time.

## Frequently asked questions

### How does SOX relate to SOC 1?

Companies rely on SOC 1 reports from service organisations to cover controls outsourced to them when assessing internal control over financial reporting.

Related: https://securei3.com/standards/soc-1/, https://securei3.com/standards/india-ifc/

Contact: https://securei3.com/contact/: info@securei3.com