SOX 404 readiness is easy to overstate until an auditor tests it. This scores your program across five dimensions so you see the real gaps before they become findings.
What this tool does
You rate your program across controls, documentation, testing, remediation, and governance; it produces an overall score and a dimension breakdown.
Who it's for
Controllers and CFOs at newly public companies and accelerated filers building or hardening a SOX program.
How to use it — step by step
- Rate each dimension. Controls, documentation, testing, remediation, governance.
- Get your score. Overall and by dimension, out of 200.
- Find the weakest link. The lowest dimension is usually where a finding will start.
- Prioritise remediation. Fix the weakest dimension first.
How to read your result
A high overall score with one weak dimension is still a risk — auditors find the weakest link. Use the breakdown to target, not the average to reassure.
Worked examples
The same tool behaves differently depending on what you put in. Here are 3 situations.
Newly public, first 404(a)
Inputs: Management's own assessment year one.
What the tool shows: Usually flags documentation and testing as the gaps for first-timers.
What to do: Build the documentation and a testing calendar early.
Accelerated filer needing 404(b)
Inputs: Auditor attestation required.
What the tool shows: Raises the bar — testing rigor and evidence become critical.
What to do: Get testing and evidence audit-ready well ahead.
Remediating a prior material weakness
Inputs: You had an MW last year.
What the tool shows: Weights remediation and governance heavily.
What to do: Document remediation and prove operating effectiveness over time.
Common questions
What's 404(a) vs 404(b)? (a) is management's assessment; (b) adds the auditor's attestation for accelerated filers.
Is the score audit-grade? It's a self-assessment to find gaps — your evidence makes it real.
Does this replace an auditor? No — verify readiness with your auditor.