Docs/Internal Control (SOX)

Internal Control (SOX) FAQ

100 SOX / J-SOX questions for banks and listed companies covering control environment, risk assessment, control activities, ITGC, and financial reporting

Back to Library

Internal Control (SOX) FAQ

🟥 A. Control Environment (1-20)

🟧 B. Risk Assessment (21-40)

🟩 C. Control Activities (41-60)

🟦 D. ITGC (IT General Controls) (61-80)

🟫 E. Financial Reporting (81-100)

Internal Control (SOX) FAQ

🟥 A. Control Environment (1-20)

1.Does Lendler impact SOX compliance?

2.Is a SOC report available?

3.Management philosophy?

4.Organizational structure?

5.Competence?

6.Accountability?

7.HR policies?

8.Code of conduct?

9.Whistleblower program?

10.Board oversight?

11.Risk appetite?

12.Internal audit?

13.External audit?

14.Regulatory compliance?

15.Financial reporting?

16.IT governance?

17.Data governance?

18.Third-party risk?

19.Fraud risk management?

20.Tone at the top?

🟧 B. Risk Assessment (21-40)

21.Risk assessment process?

22.Objective setting?

23.Risk identification?

24.Fraud risk assessment?

25.Change management risk?

26.IT risk?

27.Regulatory risk?

28.Operational risk?

29.Financial risk?

30.Reputational risk?

31.Strategic risk?

32.External factors?

33.Internal factors?

34.Risk analysis?

35.Risk response?

36.Management review?

37.Documentation?

38.Communication?

39.Monitoring?

40.Integration?

🟩 C. Control Activities (41-60)

41.Preventive controls?

42.Detective controls?

43.Automated controls?

44.Manual controls?

45.Authorization?

46.Segregation of Duties (SoD)?

47.IT controls?

48.Physical controls?

49.Performance reviews?

50.Information processing?

51.Asset security?

52.Documentation?

53.Control ownership?

54.Exception handling?

55.Control testing?

56.Remediation?

57.Verification?

58.Reconciliation?

59.Master data management?

60.Outsourcing controls?

🟦 D. ITGC (IT General Controls) (61-80)

61.Access to programs and data?

62.Program changes?

63.Program development?

64.Computer operations?

65.User access management?

66.Privileged access?

67.Password policy?

68.Network security?

69.Physical security?

70.Backup and recovery?

71.Incident management?

72.Patch management?

73.Database security?

74.Application security?

75.System monitoring?