SOX Compliance Checklist: Requirements, Steps, and Internal Controls

Your board just set a date for the IPO, or a public acquirer just signed a term sheet, and someone asked whether your controls are ready for a SOX audit. You need an answer that's a checklist, not a lecture.

A SOX compliance checklist walks through the concrete, checkable steps a company takes to satisfy Sections 302, 404, 409, 802, and 906 of the Sarbanes-Oxley Act: scoping and materiality, entity-level and IT general controls, internal-controls documentation, and audit-ready evidence. It's also called a Sarbanes-Oxley compliance checklist or, less formally, a SOX checklist, all referring to the identical set of steps.

This isn't the place to learn what SOX is in the first place. If you need that first, our full SOX compliance guide covers the law, the stakes, and when a private company should start. This piece assumes you already know that and want the execution list.

By the end of this, you'll have a working SOX compliance checklist you can hand to your controller, your auditor, or your board. Here's what it covers:

• What this checklist is for, and what it deliberately isn't
• Scoping and materiality, the step that has to happen before anything else on this list means anything
• The core requirements checklist, section by section: 302, 404, 409, 802, and 906
• A dedicated IT general controls checklist
• What real internal-controls documentation looks like, with a worked example
• Getting audit-ready: the evidence an external auditor will actually ask for
• A quick department-by-department view: HR, finance, and IT
• The mistakes that turn a first SOX cycle into an expensive one

What a Sarbanes Oxley Compliance Checklist Actually Covers

A SOX compliance checklist is a structured list of the controls, documentation, and evidence a company needs in place to satisfy its Section 302 and Section 404 obligations under the Sarbanes-Oxley Act, organized so each item can be assigned, tracked, and marked done.

That sounds simple, but two very different things get called a "SOX checklist," and confusing them wastes real time. One is a program-maturity reassessment: a checklist for a company that already has a SOX program and wants to refocus one that's drifted. The other is a first-time setup checklist, for a company building its program from nothing. This article is the second one.

There's a third version worth ruling out too: a pure IT-tooling checklist that treats SOX as a technology problem to solve with the right security software. IT general controls are a real, dedicated section further down, but they're one piece of a broader program, not the whole thing.

Whether you found this searching for a sarbanes oxley compliance checklist or the shorter "SOX checklist," the answer is the same list either way. The spelling doesn't change what's on it.

If you're still asking what SOX itself requires and who it applies to, not just how to execute it, the SOX compliance guide is the better starting point, including its section on exactly when a pre-IPO company should start.

Before You Start This SOX Compliance Checklist: Scoping and Materiality

Nothing on this checklist means anything until scope is set. Skipping this step is the single most common reason a first SOX cycle runs over budget and over schedule.

Scoping means identifying which entities, business processes, and financial statement line items are actually significant enough to warrant control testing. A subsidiary contributing 2% of consolidated revenue doesn't need the same scrutiny as the one generating 60% of it.

Materiality is the dollar threshold above which a misstatement would actually change a reasonable investor's decision. Auditors commonly start from a benchmark like 5% of pre-tax income, then adjust for qualitative factors.

Treat scoping and materiality as the checklist's step zero:

1. List every legal entity and business process that feeds the consolidated financial statements.
2. Rank them by contribution to revenue, assets, or another relevant metric.
3. Set a materiality threshold using a recognized benchmark, then document the reasoning, not just the number.
4. Draw the scope line and write down which entities and processes fall inside it, and why the rest don't.

Get this wrong and you'll either test controls nobody needed tested, or miss the ones that actually matter. Both cost real time later.

A Full SOX Compliance Requirements Checklist, Section by Section

SOX runs across eleven titles, but a first-time compliance program organizes itself around five sections that do nearly all of the practical work. Use this SOX compliance requirements checklist as the backbone; everything else in the Act is background context, not a separate workstream.

Section 302 — Executive Certification Checklist

• CEO and CFO personally review each quarterly and annual report before it's filed
• A documented sign-off packet exists showing what they reviewed and when
• Any significant deficiency or fraud involving management gets reported to the auditors and audit committee before certification
• The 90-day disclosure-controls evaluation window is tracked, not assumed

Your SOX 404 Compliance Checklist for Internal Controls Over Financial Reporting

Section 404 generates most of a SOX program's actual workload, and it splits into two halves.

Use this SOX 404 compliance checklist to work through both halves in order:

• Entity-level controls (tone at the top, whistleblower channel, code of conduct) documented
• Process-level and transaction controls mapped for every in-scope account
• IT general controls identified and linked to the financial processes they support (see the dedicated ITGC checklist below)
• A written process narrative or flowchart for every material transaction cycle
• Management's written conclusion on ICFR effectiveness drafted ahead of the 10-K deadline, not during it

Section 409 — Real-Time Disclosure

• A defined trigger list for what counts as a "material change" (restatement, major asset impairment, an executive departure tied to a financial issue)
• An owner assigned to the 4-business-day disclosure clock once a trigger fires
• A documented escalation path from whoever spots the issue to whoever files the disclosure

Section 802 and 906 — Recordkeeping and Certification Penalties

• A written retention policy covering financial records, audit workpapers, and related emails
• Retention enforced through the actual systems used (email, document storage), not just a policy PDF
• Section 906's criminal certification folded into the same sign-off process as Section 302, not treated as a separate step

The SOX IT Compliance Checklist: IT General Controls

IT general controls, ITGCs, are the technology-layer controls that make every other financial control trustworthy. A well-designed journal-entry approval workflow means nothing if someone can edit the general ledger directly, bypassing it entirely.

Use this SOX IT compliance checklist to work through each area:

• Access to every in-scope financial system reviewed on a defined, recurring cadence
• Change-management workflow enforced for financial systems, with evidence of approval before deployment
• Backup and job-scheduling logs retained and reviewed, not just configured once
• Every vendor touching financial data has a reviewed SOC 1 or SOC 2 report on file, with findings documented

That last item is easy to underweight. A cloud hosting provider, a payroll processor, or any tool writing directly into the general ledger is effectively part of your control environment, and an auditor will expect evidence you reviewed their report, not just that you signed a contract.

What Belongs in Your SOX Compliance Checklist Internal Controls Section

"Internal controls" as a checklist line item means nothing without a real artifact behind it. Naming "segregation of duties" isn't the same as showing what one control actually looks like.

Every SOX compliance checklist internal controls entry needs all four of those pieces every time:

• A stated control objective (what risk this control addresses)
• A specific control activity (the actual mechanism, not a policy statement)
• A defined testing frequency
• Evidence an auditor can actually pull and test, not a verbal assurance

Build a risk-control matrix (RCM) row for every material control using this shape. A company doing this for the first time doesn't need hundreds of rows on day one, it needs enough to cover every in-scope process from the scoping step above, with the rest built out over the following cycles.

Getting Audit-Ready: A SOX Compliance Audit Checklist

Building the controls and proving them to an external auditor are two different jobs. This SOX compliance audit checklist covers the second one.

A checklist that only lives in someone's head isn't a control an auditor can test. If the evidence isn't written down, dated, and retrievable, it doesn't exist for audit purposes, no matter how well the control actually worked. — Editor's Note

• An evidence repository set up before testing starts, not assembled reactively when the auditor asks
• Walkthroughs scheduled with control owners well ahead of testing, so gaps surface early
• Every control failure classified correctly: deficiency, significant deficiency, or material weakness
• A remediation tracker for anything that fails, with an owner and a deadline
• Prior-period findings reviewed to confirm they actually stayed fixed, not just closed on paper

A significant deficiency is important enough to report to the audit committee but doesn't require public disclosure. A material weakness is severe enough that a material misstatement could go undetected, and it has to be disclosed in a public filing. Getting that classification wrong in either direction is one of the most common ways a first audit goes sideways, covered in more detail below.

This SOX Compliance Checklist by Department: HR, Finance, and IT

Several checklist items are specific enough to one department, HR most of all, that they're worth naming directly as a standalone hr sox compliance checklist rather than burying them inside the general sections above.

A dedicated hr sox compliance checklist row matters more than it looks: HR usually owns the offboarding trigger that IT's access-revocation control depends on, and a slow handoff between the two is a genuinely common control failure, not a hypothetical one.

Common Mistakes in a First SOX Compliance Checklist Cycle

Most first-time SOX programs don't fail on one dramatic error. They fail on small, repeated ones that compound across a cycle or two.

• Treating the checklist as one-and-done. SOX controls get tested every reporting period, not once at the start. A checklist that isn't revisited quarterly is out of date the moment something in the business changes.
• Under-scoping IT systems. Access management, change management, and system operations get treated as an afterthought next to financial-process controls, even though a weak technology layer undermines every control built on top of it.
• Missing walkthrough evidence. "We reviewed it" isn't evidence. Who reviewed it, when, what they looked for, and what they'd have done if they'd found a problem, is.
• No segregation-of-duties check. The same person who initiates and approves a transaction is a finding waiting to happen, and it's one of the easiest things to catch before an auditor does.
• Applying an enterprise timeline to a smaller filer. The commonly cited $1-2 million and 10,000-hour figure describes an established public company's steady-state program, not a first-year, smaller-scope one. Scope your own timeline and budget to your actual filer tier.
• Skipping vendor SOC 1 or SOC 2 review. A signed contract with a payroll processor or cloud host isn't evidence their controls work. Pulling and actually reading their report is.
• Waiting until the S-1 process to start. According to KPMG's IPO material weakness study, between 40% and 58% of companies going through a traditional IPO disclosed at least one material weakness, compared to roughly 15% across the broader public company population per Baker Tilly's analysis of SEC EDGAR filings. That gap is what happens when controls get built under deadline pressure instead of ahead of it.

Regulatory scrutiny is tightening too. In March 2026, the SEC's Division of Enforcement stood up a dedicated SOX Group, and the PCAOB separately tightened AS 1105, Audit Evidence, raising the bar for what counts as sufficient evidence. A checklist built to yesterday's evidence standard is building toward a bar that's actively moving.

How ComplyJet Fits Into SOX Readiness

To be direct: ComplyJet doesn't audit or certify SOX compliance. SOX isn't an attestation framework the way SOC 2 or ISO 27001 are, it's a federal law with its own audit regime built around external auditors and the PCAOB.

Where we do fit in is the groundwork. We support SOC 1 and SOC 2 for growth-stage companies, and a lot of the access-control, change-management, and monitoring evidence built for either report is the same evidence this checklist's IT general controls section asks for. Building that evidence once, well, instead of twice under two different deadlines, is the more efficient path.

FAQs

What is a SOX compliance checklist?

A SOX compliance checklist is a structured list of the controls, documentation, and evidence a company needs to satisfy Sections 302 and 404 of the Sarbanes-Oxley Act, organized by control area so each item can be assigned and tracked. This one is built for a first-time program, not a company reassessing an existing one.

What's the difference between this checklist and a SOX program reassessment?

A reassessment checklist helps a company with an existing SOX program refocus one that's drifted over time. This checklist is for building a program from nothing, the more common situation for a pre-IPO or newly public company. The control areas overlap, but the starting point and the pace are different.

Is there a downloadable SOX compliance checklist PDF?

There's no single official SOX compliance checklist PDF the way there is for some other frameworks. This article is built as a scannable, checkbox-formatted page for the same purpose, kept current with the actual sections of the law rather than a static download that goes stale.

Can I use this article as a SOX compliance checklist template?

Yes. Treat this as a SOX compliance checklist template: each section above is written as checkbox items you can copy directly into your own tracker, spreadsheet, or project-management tool, organized the same way an auditor will expect your evidence organized.

What's the difference between SOX Section 302 and Section 404?

Section 302 requires the CEO and CFO to personally certify that a report is accurate, signed every quarter. Section 404 requires management to document, assess, and report on the internal controls behind those numbers, with larger filers also getting an external auditor's opinion under Section 404(b).

Do private, pre-IPO companies need to follow this checklist?

Not legally, but a company heading toward an IPO, an acquisition by a public company, or a reverse merger will need SOX-aligned controls in place well before that transaction closes. Starting 12 to 18 months ahead of an anticipated IPO is the realistic planning window, not the few months before filing.

How is a SOX checklist different from a SOC 2 checklist?

SOX is a federal law focused on financial-reporting integrity, with legal and criminal consequences for public companies. SOC 2 is a voluntary attestation focused on security and data-handling controls, used commercially to earn customer trust. Some IT general controls overlap between the two, but the legal stakes and the audience are different.

What happens if a company fails a SOX compliance checklist item?

A failed control gets classified as a deficiency, a significant deficiency, or a material weakness, depending on how likely it is to lead to an undetected material misstatement. A material weakness has to be disclosed publicly; a significant deficiency is reported internally to the audit committee but doesn't require public disclosure.

Related Reading

• SOX Compliance: What It Is, Requirements, and How to Prepare, the full guide behind every item on this checklist, including the pre-IPO framing this checklist assumes.
• SOC 1 vs SOC 2: Key Differences, Compliance, and Which You Need, for the adjacent frameworks ComplyJet actually supports.
• SOC 2 vs. SOX Compliance Guide, for readers deciding between the two frameworks rather than executing SOX itself.