What are common ICFR control categories and who actually owns them under SOX?

Question

AcadiFi · Accepted Answer

ICFR means controls designed to provide reasonable assurance over reliable external financial reporting. The controls can be preventive or detective, manual or automated, but they are all still management's responsibility. Internal audit may evaluate them, yet management owns design, implementation, and operation.

Assume Pine Ridge Medical has annual revenue of $54 million. Its ICFR structure includes a three-way match for invoices above $4,000, a monthly bank reconciliation reviewed by the controller, system-based journal-entry restrictions, quarterly user-access reviews, and a close checklist signed by the finance manager. The three-way match and system restrictions are mainly preventive. The bank reconciliation and close review are detective. Some are automated, some manual, and many are hybrids. What makes them ICFR is their connection to accurate financial statements, not a special label stamped on them.

A quick CIA rule is to ask two questions: does the control support reliable external reporting, and who owns it operationally? If it supports reporting, it may be ICFR. If management runs it, management owns it. External auditors may test it, regulators may care about it, and internal audit may assess it, but ownership still sits with management. That distinction matters both on the exam and in practice. Practice more in our CIA question bank.

What are common ICFR control categories and who actually owns them under SOX?

Master Part 1 with our CIA Course

Related Questions

Practice Questions