The objective of this sample audit program is to ensure that Sarbanes-Oxley (SOX) Section 404 processes are documented to communicate a clear understanding of the business activity, including its related risks and controls, roles, and responsibilities.

The steps in this work program are intended to ensure all changes made to process documentation are reviewed for accuracy and completeness. Topics of focus include documenting an understanding of the process, as it relates to SOX compliance, and ensuring that all changes made to existing process maps and risk and control matrices (RCM) are reviewed for accuracy and completeness.