SOX testing explained: how controls are tested, where AI enters the test, and what 10-K filers say about it

SOX control testing has two possible testers: management evaluates whether its controls over financial reporting are designed to catch a material misstatement and whether they operated, under the SEC’s interpretive guidance of 2007-06-20, and at an accelerated or large accelerated filer that is not an emerging growth company the auditor also tests the same design and operation in the integrated audit under PCAOB AS 2201.¹²⁸ AI changes the inputs to that test more than the test itself: of the 3,271 10-Ks filed in 2025 that use the phrase “artificial intelligence”, 127 also use the exact phrase “information technology general controls” and 83 “automated controls”, the vocabulary of the IT side of the test.⁴

Neither the SEC’s 2007 guidance nor the SEC’s 2007 order approving the auditing standard uses the words artificial intelligence.¹² Their structure still decides what an AI component has to survive, which is why the sequence below is the useful place to start.

What SOX testing is and who does it

Section 404 of the Sarbanes-Oxley Act gives the work up to two owners. Management assesses internal control over financial reporting and reports on it in the 10-K. Section 404 requires registered public accounting firms to “attest to and report on” management’s assessment, but not at every issuer: “SOX Section 404(c) exempts from Section 404(b) any issuer that is neither a large accelerated filer nor an accelerated filer,” and the JOBS Act of 2012 exempts emerging growth companies from Section 404(b).⁸ The SEC’s 2020 amendments moved certain low-revenue issuers out of the accelerated filer categories; such an issuer still has to “establish and maintain ICFR and have management assess the effectiveness of ICFR,” without the auditor’s attestation.⁸ Where the attestation applies, the auditor’s report under Auditing Standard No. 5, which the SEC approved on 2007-07-27, “will express one opinion” on whether the company maintained effective internal control as of its fiscal year-end.² To give it, the standard “requires the auditor to evaluate and test both the design and the operating effectiveness of internal control.”² The standard is now numbered AS 2201, “An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements,” the title the PCAOB uses for it in its 2024 rulemaking.³

The SEC’s guidance for management describes “a top-down, risk-based evaluation” and calls an evaluation that follows it “one way to satisfy the evaluation requirements” of Exchange Act Rules 13a-15(c) and 15d-15(c).¹

Scoping and risk assessment in the SEC guidance

The guidance sets the order. Management “identifies the risks to reliable financial reporting, evaluates whether controls exist to address those risks, and evaluates evidence about the operation of the controls.”¹ The purpose is a reasonable basis for the annual assessment of whether any material weakness exists at fiscal year-end.¹

Scoping is where an AI component first shows up, because the guidance asks about controls by what they depend on. Controls “may be automated, dependent upon IT functionality, or a combination of both manual and automated procedures,” and in that case management’s evaluation “generally considers the design and operation of the automated or IT dependent application controls and the relevant IT general controls over the applications providing the IT functionality.”¹ The guidance adds that “the proper and consistent operation of automated controls or IT functionality often depends upon effective IT general controls.”¹

Walkthroughs, design effectiveness and operating effectiveness

Design is a judgment about whether the controls, “if operating properly, can effectively prevent or detect misstatements that could result in material misstatements in the financial statements.”¹ Operating effectiveness asks something different: “whether the control is operating as designed and whether the person performing the control possesses the necessary authority and competence to perform the control effectively.”¹

Evidence of operation, the guidance says, “comes from direct tests of controls, on-going monitoring, or a combination of both.”¹ Direct tests are periodic and done by people with “a high degree of objectivity relative to the controls being tested”; on-going monitoring includes self-assessment by the people who run the control.¹ How much evidence is needed scales with risk. Among the factors in whether a control might fail, the guidance lists “the type of control (that is, manual or automated) and the frequency with which it operates,” its complexity, the risk of management override and the judgment required.¹

The walkthrough is the auditor’s tool for following a transaction through the process and the controls. The SEC’s 2007 order records that a small number of commenters wanted clarification on relying on the work of others “when conducting walkthroughs,” and that the Commission found the standard “sufficiently clear about the extent to which the auditor can use the work of others.”²

Sample sizes and automated controls in AS 2201

The guidance treats automated controls as cheaper to evidence once IT general controls are in place. “When adequate information technology ('IT') general controls exist and management has determined that the operation of such controls is effective, management may determine that automated controls are more efficient to evaluate than manual controls.”¹ Its example of a lower-risk control is an automated one “subject to a system that is stable (that is, has not undergone significant change) and is supported by effective IT general controls.”¹

That sentence is where an AI component parts company with a classic automated control. A matching rule in an ERP runs the same way until its code is changed, and change management is built to see that change. A model that a vendor retrains has changed even if no one at the company edited a line of code. The guidance’s phrase “has not undergone significant change” becomes a question to answer, not an assumption.

The PCAOB’s 2024 amendments, which take effect for audits of fiscal years beginning on or after December 15, 2025, point the same way for the auditor’s own tools: among their changes, they “Emphasize the importance of controls over information technology.”³ The release states that it does not address “other technology applications used in audits (e.g., blockchain or artificial intelligence).”³

The auditor’s side of the same test was made lighter in 2007, and the SEC’s approval order lists how. Auditing Standard No. 5 eliminated procedures “by, among other things, removing the requirement to evaluate management’s process; permitting consideration of knowledge obtained during previous audits; refocusing the multi-location testing requirements on risk rather than coverage; and removing unnecessary barriers to using the work of others.”² It also directs the auditor “to tailor the audit to reflect the attributes of smaller, less complex companies.”²

Two of those changes bear on an AI component. Knowledge from previous audits lets an auditor lean on what it learned about a stable system last year, which a retrained model undercuts. And the standard lets the auditor use the work of others, which puts weight on whoever inside the company tests the model’s controls.² The PCAOB received 175 comment letters on the draft standard and the Commission received 37 on the version it approved.²

Where an AI component changes the testing question

Each step in the sequence above has an AI line. They come down to three tests the 2007 documents already require, applied to a new object.

• Scope. If a model produces an estimate, a match or a classification that reaches the statements, the controls over that output are in scope, and so are the IT general controls over the model, its data and its changes.¹
• Design. A review control over a model’s output is only as good as the reviewer’s ability to tell a wrong output from a right one. The design question is whether the control, “if operating properly,” would catch it.¹
• Operation. The person performing a control must have “the necessary authority and competence.”¹ When the performer is a model with a reviewer behind it, the evidence has to cover both.

What 10-Ks say about testing, counted by year

The words of the test are rarer in 10-Ks than the test itself. EDGAR full-text search, run one calendar year at a time and reduced to distinct filings, finds the exact phrase “information technology general controls” in 84 of the 6,933 10-Ks filed in 2021 (1.2%) and in 251 of the 6,431 filed in 2025 (3.9%).⁴⁵ “Automated controls” went from 53 filings (0.8%) to 110 (1.7%).⁴⁵ Many filers write “IT general controls” or “ITGCs” instead, which these exact-phrase counts do not catch, so the figures are a floor for the vocabulary, not a count of companies that test IT controls.

The 2025 figure is the year the count stopped growing: 257 filings used the IT phrase in 2024 and 251 in 2025.⁴

What filers say about AI or automation in testing

Putting the two vocabularies side by side gives a rough measure of overlap. Among 10-Ks that contain “artificial intelligence”, the share that also contain “information technology general controls” rose from 8 of 836 in 2021 (1.0%) to 127 of 3,271 in 2025 (3.9%); the share with “automated controls” stayed between 1.8% and 2.8%, 83 filings in 2025.⁴ The phrase “material weakness” is far more common beside AI, in 2,623 of the 3,271 filings in 2025, because risk factors routinely warn of material weaknesses as a general risk.⁴ Both phrases can sit anywhere in a filing, so these counts are of filings that use both sets of words, not of passages that join them.

The clearest statements come from smaller companies remediating a weakness, in 10-Q Item 4 rather than in the 10-K. One amended 10-Q describes an AI tool as a supplemental control.⁶

TOMI Environmental Solutions listed among its remediation actions in a 10-Q filed 2026-08-14 that it “Integrated AI-assisted technical research tools to support complex U.S. GAAP research and financial statement disclosures.”⁷ Both passages are in this site’s filings log under the CONTROLS label.

From test result to deficiency evaluation

A failed test is the start of the last step. “If management determines that a deficiency in ICFR exists, it must be evaluated to determine whether a material weakness exists.”¹ The definition the guidance cites is the one in Rule 12b-2 and Rule 1-02 of Regulation S-X: a material weakness is “a deficiency, or a combination of deficiencies, in ICFR such that there is a reasonable possibility that a material misstatement of the registrant’s annual or interim financial statements will not be prevented or detected on a timely basis.”¹

For a model-driven control, the evaluation turns on reach. A failed review of one model output is one deficiency in one account. A failure in the IT general controls over the model, its access or its change management, touches every control that depends on it, which is the same reasoning the guidance applies to any IT dependency.¹ What companies say about AI and internal control in their own words is collected in AI and internal control over financial reporting and AI in the controls section, and the passages are filed under the controls and audit topic.