Section 404 of The Sarbanes-Oxley Act of 2002 (SOX) requires public companies to assert annually that internal control over financial reporting (ICFR) is designed and operating effectively. The stronger a company’s compliance environment and the greater the maturity of its processes, the less independent testing is needed to support management’s assertion regarding the effectiveness of ICFR.

This issue addresses the importance of integrating self-assessment, entity-level monitoring and independent tests of controls into a coordinated approach to provide evidence supporting management’s assertion in the annual internal control report.