Internal control over financial reporting (ICFR) is one of the most important responsibilities facing public companies and businesses preparing to enter U.S. capital markets. Effective financial controls help organizations maintain accurate accounting records, reduce the risk of material misstatements, and produce reliable financial statements for investors and regulators.
For SEC reporting companies, ICFR is connected to the Sarbanes-Oxley Act (SOX), management’s financial reporting responsibilities, and, for certain issuers, independent auditor attestation requirements. Companies planning an IPO, completing a De-SPAC transaction, or approaching their first public company audit must evaluate controls, documentation, financial systems, and management oversight.
This guide explains ICFR, SOX 404, entity-level controls, deficiencies and testing, and includes a practical entity level controls checklist for CFOs, controllers, and audit committees.
What Is Internal Control Over Financial Reporting (ICFR)?
ICFR is a process designed to provide reasonable assurance about the reliability of financial reporting and preparation of external financial statements under the applicable accounting framework, generally U.S. GAAP for domestic public companies.
· Maintaining records that accurately reflect transactions and asset dispositions.
· Ensuring transactions are recorded appropriately and expenditures are authorized.
· Preventing or detecting unauthorized use or disposition of assets that could materially affect financial statements.
Why ICFR Matters for Public Companies
Weak controls can increase the risk of material errors, incomplete disclosures, unauthorized journal entries, delayed SEC filings, restatements, and adverse internal control audit findings. No system can guarantee the prevention or detection of every error or fraud, but well-designed controls help management address material reporting risks.
For broader reporting obligations, see SEC Audit Requirements for Public Companies: 2026 Guide.
How Does ICFR Work?
ICFR links identified financial reporting risks to specific activities. A company facing a risk of premature revenue recognition might require customer contract approval, review revenue calculations, reconcile billing to the general ledger, and investigate unusual adjustments. Every control should have an owner, frequency, objective, and retained evidence.
Preventive Controls vs. Detective Controls
Control type | Purpose | Example |
Preventive | Reduce the risk of error before it occurs | Journal entry approval before posting |
Detective | Identify errors after they occur | Monthly bank reconciliation |
Manual Controls vs. Automated Controls
Manual controls include reconciliations, approvals, and management reviews. Automated controls include system validations, workflow approvals, and access restrictions. Technology-dependent controls also require suitable IT general controls supporting user access, changes, and operations.
SOX 404 Requirements: What Public Companies Must Know
Section 404 of the Sarbanes-Oxley Act establishes management assessment and, for certain issuers, independent auditor attestation responsibilities concerning ICFR.
SOX Section 404(a): Management Assessment
Management identifies reporting risks, selects a suitable framework, evaluates control design and operation, assesses deficiencies, and prepares applicable annual management disclosures. Management retains responsibility for control design, implementation, operation, and assessment.
SOX Section 404(b): Auditor Attestation
Issuers subject to Section 404(b) obtain an independent auditor’s opinion on ICFR, ordinarily as part of an integrated audit performed under PCAOB AS 2201. Qualifying emerging growth companies and non-accelerated filers are generally exempt from 404(b), while newly public companies may have applicable first-year transition relief. Reporting status and effective requirements must be evaluated for each issuer.
Requirement | SOX 404(a) | SOX 404(b) |
Responsible party | Management | Independent registered auditor |
Outcome | Management’s ICFR assessment | Independent auditor opinion on ICFR |
Applicability | Applicable issuers with transition rules | Issuers subject to attestation; exemptions apply |
Related reading: SOX Compliance Checklist for Growth-Stage Public Companies.
The Five Components of an ICFR Framework
Control Environment
The organizational foundation for ethics, accountability, competence, and oversight.
· Board and audit committee oversight
· Appropriate authority and responsibility
· Codes of conduct and management accountability
Risk Assessment
The process of identifying and evaluating risks of material misstatement.
· Fraud and management override
· Revenue and estimates
· New systems, acquisitions and complex transactions
Control Activities
Procedures designed to address identified financial reporting risks.
· Approvals and reconciliations
· Segregation of duties
· Access and accounting estimate reviews
Information and Communication
Timely collection and escalation of reliable reporting information.
· Financial reporting policies
· Escalation channels
· Reliable source data
Monitoring Activities
Ongoing or periodic evaluation of whether controls remain effective.
· Management review and internal audit
· Deficiency tracking
· Remediation follow-up
What Are Entity-Level Controls?
Entity-level controls operate at the organizational or multiple-business-unit level. They include audit committee oversight, integrity policies, fraud risk assessment, management reviews, financial close oversight, and some organization-wide IT controls. PCAOB AS 2201 uses a top-down approach that considers entity-level controls before selecting controls addressing significant accounts and disclosures.
Entity-Level Controls vs. Process-Level Controls
Feature | Entity-level | Process-level |
Scope | Across organization | Specific transactions and accounts |
Typical examples | Ethics, governance, oversight | Reconciliations, invoice approvals |
Common owners | Board and executives | Process owners and finance teams |
Role | Influence reporting risk/control environment | Address specific misstatement risks |
Entity Level Controls Checklist for Public Companies
The checklist below is a starting point for tailoring controls to the organization’s risk profile. Checking a box does not prove that a control is properly designed or operating effectively.
Governance and Audit Committee Oversight
Define board and audit committee oversight responsibilities.
Adopt an appropriate audit committee charter.
Document independent auditor communications.
Escalate significant accounting issues.
Assign financial reporting responsibility.
Ethics and Management Accountability
Maintain a code of conduct.
Communicate financial reporting expectations.
Provide appropriate ethics training.
Establish required whistleblower procedures.
Assess risks of management override.
Financial Reporting Risk Assessment
Identify significant accounts and disclosures.
Assess fraud and financial reporting risks periodically.
Evaluate complex transactions promptly.
Reassess risks following business changes.
Document conclusions and ownership.
Financial Reporting and Close Oversight
Assign close responsibilities.
Review significant journal entries.
Reconcile material accounts.
Review consolidations and estimates.
Review material financial statement disclosures.
IT and Information Systems
Restrict access to financial systems.
Review privileged access.
Approve and test significant system changes.
Protect financial reporting data.
Evaluate relevant third-party service controls.
Monitoring and Remediation
Monitor control operation.
Record control deficiencies.
Set remediation owners and target dates.
Retest remediated controls.
Report material issues to appropriate governance bodies.
Further reading: Internal Audit Services: Building a Strong Compliance Foundation.
How to Implement an Effective ICFR Program
Step 1: Identify Significant Accounts and Risks
Start with financial statements and the assertions, accounts and disclosures susceptible to material misstatement.
Step 2: Document Key Financial Processes
Prepare process narratives, flowcharts, risk-control matrices, and supporting policies that reflect actual operations.
Step 3: Design Controls Around Risks
Specify which risk each control addresses and how the review or approval would detect or prevent misstatements.
Step 4: Assign Control Owners
Record the owner, frequency, control objective, evidence, and escalation rules for every key control.
Step 5: Evaluate Control Design
Determine whether the control, if executed as described, is capable of addressing the identified risk.
Step 6: Test Operating Effectiveness
Examine approvals, reconciliations, system logs, samples, and evidence relevant to control performance.
Step 7: Remediate Deficiencies
Redesign inadequate controls, improve training or access management, and collect evidence of effective operation.
Step 8: Establish Continuous Monitoring
Reassess controls when business processes, applications, personnel, or accounting standards change.
Understanding ICFR Deficiencies and Material Weaknesses
Control Deficiency
A control deficiency arises when design or operation does not allow personnel to prevent or detect misstatements on a timely basis in the normal course of their responsibilities.
Significant Deficiency
A significant deficiency is less severe than a material weakness but important enough to merit attention by those responsible for overseeing financial reporting.
Material Weakness
A material weakness is a deficiency or combination of deficiencies creating a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis. Accurate financial statements can coexist with a material weakness; nevertheless, management cannot conclude ICFR is effective when a material weakness exists.
Classification | Meaning | Management response |
Control deficiency | Design or operation issue | Evaluate and correct |
Significant deficiency | Warrants governance attention | Communicate and remediate |
Material weakness | Reasonable possibility of material misstatement not prevented or detected | Assess disclosure, controls opinion and remediation |
How Does an ICFR Audit Work?
Planning and Risk Assessment
The independent registered auditor identifies financial statement risks, significant accounts, controls, and the nature of evidence needed under a risk-based approach.
Testing Controls
The auditor tests design and operating effectiveness of selected controls, based on risk and engagement circumstances.
Evaluating Deficiencies
Identified deficiencies are evaluated individually and in combination, with required communications to management and the audit committee.
Issuing an ICFR Opinion
Where required, the auditor expresses an opinion on whether ICFR was effective, in all material respects, as of the assessment date. The ICFR and financial statement audit opinions have distinct objectives.
Learn about related assurance engagements in What Is an SEC Audit?.
Common ICFR Challenges for Newly Public Companies
Limited Segregation of Duties
Lean teams may combine authorization and recording responsibilities. Evaluate compensating controls when separation is impractical.
Inadequate Documentation
Informal procedures may lack evidence of what was reviewed, by whom, and when.
Weak IT General Controls
Poor access governance or uncontrolled system changes may undermine automated controls.
Inconsistent Management Reviews
Reviews lacking precision may not detect a material misstatement.
Unresolved Accounting Issues
Acquisitions, equity instruments, revenue judgments and estimates create additional risks.
Insufficient Remediation Time
Corrected controls may need to operate for sufficient time to demonstrate effectiveness.
ICFR Readiness Checklist Before the Annual Audit
Confirm SEC reporting and SOX 404 obligations.
Determine whether 404(b) attestation applies.
Select a suitable recognized control framework.
Complete financial reporting risk assessment.
Identify significant accounts and disclosures.
Document entity-level and process-level controls.
Maintain narratives and risk-control matrices.
Review IT general controls.
Assign control owners and evidence requirements.
Test relevant controls as appropriate.
Evaluate, communicate and remediate deficiencies.
Retain assessment evidence.
Coordinate with audit committee and external auditor.
When Should a Public Company Engage an ICFR Audit Firm?
Evaluate independent audit requirements before annual reporting deadlines, and especially when approaching an IPO, De-SPAC transaction, accelerated filer status, the end of an attestation exemption, a complex acquisition, or material control weaknesses.
Questions to Ask a Prospective ICFR Auditor
· Is your firm PCAOB-registered and experienced in integrated audits?
· How will material financial reporting risks shape audit scope?
· What documentation should management prepare?
· How are control deficiencies communicated?
· Who will lead the engagement and what are the milestones?
· How will the auditor work with the audit committee while preserving independence?
How MBP Global LLP Supports Public Company ICFR Audits
MBP Global LLP is a PCAOB-registered public accounting firm serving public and private businesses. Its Audit & Assurance practice provides SEC and PCAOB audit engagements, public company financial statement audits, and related assurance services. Companies seeking ICFR assurance should confirm the appropriate engagement scope and applicable auditor independence requirements.
Explore Audit & Assurance Services or Contact MBP Global LLP to discuss public company audit and ICFR needs.
Frequently Asked Questions About Internal Control Over Financial Reporting
What is ICFR?
ICFR is the process designed to provide reasonable assurance over reliable financial reporting and preparation of financial statements under an applicable framework.
How is ICFR different from SOX 404?
ICFR is the control system; SOX 404 sets management reporting and, for certain issuers, independent auditor attestation obligations.
Who is responsible for ICFR?
Management establishes, operates and assesses ICFR. The audit committee oversees relevant reporting matters, while independent auditors perform required work without taking management responsibilities.
Does every public company need an ICFR audit?
No. Section 404(b) auditor attestation depends on filer status and applicable exemptions and transition provisions.
What are entity-level controls?
They are controls affecting multiple processes or the overall organization, including governance, ethics, risk assessment, and management oversight.
What is included in an entity level controls checklist?
Governance, ethics, risk assessment, reporting oversight, IT controls, monitoring, and remediation.
What is a material weakness?
A deficiency or combination creating a reasonable possibility that a material financial statement misstatement will not be prevented or detected on a timely basis.
Can financial statements be accurate if ICFR is ineffective?
Yes. A financial statement audit opinion and an ICFR effectiveness opinion address separate objectives.
Can external auditors design management’s controls?
External auditors must comply with independence rules and cannot assume prohibited management responsibilities for controls they audit.
How often should ICFR be reviewed?
Management should monitor controls throughout the year, with formal assessments and testing appropriate to risks and reporting requirements.
Conclusion: Build ICFR Into Your Financial Reporting Strategy
Effective internal control over financial reporting supports reliable statements, accountability, and consistent public company reporting. Companies should identify material risks, document and operate controls, evaluate evidence, remediate deficiencies, and revisit controls as the business changes. Entity-level controls provide an important foundation, while process-level and IT controls address specific risks.
For public company audit and ICFR assurance needs, Contact MBP Global LLP to discuss the appropriate next steps.
