SOX 404 and IPE: What Auditors Test About Company Reports

Scope and terms

This article covers United States public-company reporting: the Sarbanes-Oxley Act of 2002 (SOX), the SEC rules that implement it, and the auditing standards of the Public Company Accounting Oversight Board (PCAOB). It explains what those texts say about reports a company produces and relies on, in its own controls or as evidence for its auditor. It is educational material, not legal or audit advice.

Four terms recur:

• Internal control over financial reporting (ICFR): a process designed by or under the supervision of the principal executive and financial officers to provide reasonable assurance about the reliability of financial reporting and the preparation of financial statements in accordance with GAAP (AS 2201.A5; the SEC uses a parallel definition in 17 CFR 240.13a-15(f)).
• Information produced by the company: the PCAOB's term, used in AS 1105 paragraph .10. PCAOB staff abbreviate it "IPC" and give invoices, shipping documents and "other data and reports from company information technology systems" as examples ^[1].
• Information produced by the entity (IPE): the equivalent phrase in the international standard, ISA 500 paragraph 9, which likewise asks for evidence of accuracy and completeness and an evaluation of precision and detail. That paragraph is quoted from the extant standard; the IAASB approved exposure drafts of revised ISA 330, 500 and 520 in June 2026 and has them out for comment until 15 December 2026, so the wording may change ^[2]. Practitioners on US engagements often say "IPE" even though the PCAOB text says "company". This article uses the PCAOB wording when quoting PCAOB sources and "IPE" for the general idea.
• IT general controls (ITGCs): controls over the IT environment, such as program changes, access to programs and computer operations, that automated controls and system-generated reports depend on ^[3].

SOX 302 and 404 on one page

SOX is Public Law 107-204 ^[4]. Two sections matter here.

Section 302 directs the SEC to require the principal executive and financial officers to certify each annual and quarterly report. Among other things, the signing officers state that they are responsible for establishing and maintaining internal controls, have evaluated their effectiveness, and have disclosed significant deficiencies, material weaknesses and certain fraud to the auditors and the audit committee ^[4].

Section 404, codified at 15 U.S.C. 7262, has three parts in its current form ^[5]:

The SEC rule that operationalizes 404(a) is 17 CFR 240.13a-15. Paragraph (c) requires management to evaluate ICFR as of each fiscal year-end using "a suitable, recognized control framework" established through due process, and states that an evaluation following the SEC's interpretive guidance in Release No. 34-55929 satisfies the requirement. In practice the framework is usually the COSO Internal Control - Integrated Framework, first issued in 1992 and refreshed in 2013; COSO states that the 1992 version was superseded on 15 December 2014.

Neither Section 404 nor Rule 13a-15 mentions reports or queries; the data requirements come from the auditing standards behind the 404(b) attestation.

The integrated audit: AS 2201

AS 2201 governs an audit of ICFR that is integrated with the audit of the financial statements. Its objective is an opinion on whether ICFR is effective; because a single material weakness means ICFR is not effective, the auditor must obtain evidence sufficient for reasonable assurance about whether material weaknesses exist as of the date of management's assessment (AS 2201.02-.03).

Three provisions shape how reports enter the ICFR audit:

1. Which controls are tested. Those "important to the auditor's conclusion" about whether controls address the assessed risk of misstatement to each relevant assertion (AS 2201.39).
2. How. By inquiry, observation, inspection and re-performance, listed from least to most persuasive (AS 2201.45, .50). Re-performing a review control means re-running its inputs, including the report.
3. Dependence on data. Automated controls may depend on "related files, tables, data, and parameters", such as a rate table behind an interest calculation (AS 2201.B30).

A control that relies on a report is therefore only as effective as the report. PCAOB staff stated this directly in Staff Audit Practice Alert No. 11 (October 2013), which is listed as guidance on the AS 2201 page and cites the standard by its earlier designation, Auditing Standard No. 5: "if a control selected for testing uses system-generated data or reports, the effectiveness of the control depends in part on the controls over the accuracy and completeness of the system-generated data or reports." Supporting a conclusion on such a control "involves testing both the selected control and the controls over the system-generated data and reports." The alert adds that the same applies to "other internally-produced information used by the company in an important control." Staff alerts are not Board rules.

Audit evidence: AS 1105

AS 1105 defines audit evidence and its quality. Evidence must be sufficient (quantity) and appropriate (quality), and appropriate means both relevant and reliable (AS 1105.05-.06). Relevance depends partly on "the level of disaggregation or detail of information necessary to achieve the objective of the audit procedure" (AS 1105.07). On reliability, the standard states that information produced by the company is more reliable when the company's controls over it, "including, where applicable, its information technology general controls and automated application controls, are effective" (AS 1105.08).

The core requirement is paragraph .10:

When using information produced by the company as audit evidence, the auditor should evaluate whether the information is sufficient and appropriate for purposes of the audit by performing procedures to:

• Test the accuracy and completeness of the information, or test the controls over the accuracy and completeness of that information, including, where applicable, information technology general controls and automated application controls; and
• Evaluate whether the information is sufficiently precise and detailed for purposes of the audit.

Two features of that text are worth stating precisely. First, the auditor has a choice of route: test the information itself (substantive) or test the controls that make it accurate and complete. Second, accuracy and completeness are not enough on their own; a correct and complete report can still be too aggregated for the purpose. A footnote to .10 points to AS 2601 and AS 2201 when the information is produced by a service organization.

The current text reflects amendments adopted in PCAOB Release No. 2024-007, which revised paragraph .10 and added paragraph .10A on external information that the company provides in electronic form (for example cash receipts, shipping documents and purchase orders received from outside parties). The amendments are effective for audits of financial statements for fiscal years beginning on or after 15 December 2025 ^[6]. Paragraph .10A asks the auditor to understand the source and the company's process for receiving, maintaining and processing such information, and then either test whether the company modified it or test the controls over it. In a September 2025 policy statement the Board said it would not, through inspection or enforcement, treat the absence of separate .10A(b) testing as noncompliance where the auditor concludes there is no more than a remote possibility that the information was modified in a way that makes it unreliable ^[7].

What counts as IPE in practice

The standards do not list report types. The categories below are a working taxonomy common in practice, offered to organize testing, not a PCAOB definition.

What auditors test

The table maps each attribute to the text that requires or describes it. "Typical evidence" lists common ways to address the attribute; the standards do not prescribe specific procedures.

Common deficiencies

Two PCAOB staff publications describe recurring inspection findings in this area. Neither is a Board rule.

SAPA 11 (2013) listed, among deficiencies frequently cited in inspection reports, failures to "sufficiently test controls over the system-generated data and reports that support important controls." Its examples ^[8]:

• not testing ITGCs important to the applications that generated the data or reports;
• not testing the logic of queries or parameters used to extract data;
• not addressing identified ITGC deficiencies, or not performing other procedures over report writers once ITGCs were found ineffective;
• testing ITGCs for controls whose customized data or queries were not subject to those ITGCs.

The April 2024 Spotlight ^[1] reports that approximately 17% of the total comment forms in each of the 2021 and 2022 inspection cycles contained deficiencies where the auditor did not sufficiently test, or test controls over, the accuracy and completeness of IPC or other data and reports, including information produced by service organizations. A comment form is the PCAOB's initial communication of observed deficiencies to a firm. Observations include:

• not testing completeness of IPC used to select items for tests of details;
• not testing non-financial data used by a company's specialist, such as pension participant data;
• not identifying and testing controls over the accuracy and completeness of data used by a control owner in operating a control;
• not assessing reliability of system-generated reports used to build expectations in revenue analytical procedures;
• relying on service-organization data without testing complementary user entity controls.

Its good practices include documenting data flows jointly with IT audit specialists and keeping a central repository of reports linked to the generating application, testing approach and conclusion.

Worked example: a rebate report inside an accrual review

The following example is fictional.

Halden Therapeutics AG is a US-listed large accelerated filer, so 404(b) applies. Its gross-to-net team operates a monthly management review control: the revenue accounting manager compares the rebate accrual in the general ledger with an "Open Rebate Claims by Payer" report from the contract management system, and investigates any payer-level difference above USD 250,000.

The report is a custom saved query. At year-end it returns 3,212 claims totalling USD 41.8 million. The auditor's IPE work, following the table above, proceeds as follows.

1. Completeness. The auditor obtains a record count and total directly from the claims table for the same period: 3,247 claims, USD 43.1 million. The difference is 35 claims and USD 1.3 million.
2. Report logic. Inspection of the query shows a status filter that includes "submitted" and "validated" and omits "on hold - pending documentation", a status added to the system mid-year. All 35 missing claims carry that status. The query was last changed before the new status existed; it was never updated.
3. ITGCs. Change management over the contract system is effective, but saved queries live in a user workspace that the change process does not cover. This is the situation SAPA 11 describes: customized queries not subject to the ITGCs tested.
4. Precision. The report aggregates by payer only. Two payers each have on-hold claims above USD 250,000, so the review could not have detected the gap at its own threshold.
5. Accuracy. A sample of report lines agrees to source claims. Accuracy holds; completeness does not.

The control is not operating as designed, because its input omits records. Severity turns on the AS 2201.62-.70 factors: the reasonable possibility and magnitude of misstatement, and compensating controls. One remediation that also makes later testing cheap: put the query under change control, store each run with its parameters, row count, control total and timestamp, and make the reconciliation to the source table a documented step of the review.

Why lineage and reproducibility lower the cost of testing

Most of the work in the example was reconstruction: what query ran, with what filter, against what data, and when. A report that carries its own evidence shortens that work:

• Parameters and code captured per run. The logic test becomes a comparison of stored query text against the approved version.
• Control totals captured per run. Completeness becomes a reconciliation of two stored numbers.
• Source identifiers on each row. Accuracy sampling traces both ways without rebuilding joins: row-level data lineage.
• Re-running as of a past date. Re-performance needs inputs as they stood when the control operated, not during fieldwork; see reproducing a past state.
• Explicit status for missing values. A blank can mean zero, unknown or excluded, which matters to completeness; see blank cell vs declared unknown.

None of this replaces the auditor's procedures; it lets stored evidence be inspected rather than reconstructed.

Control evidence checklist

For each report that feeds a key control or is handed to the auditor:

• Report name, system, owner, type and the controls it supports.
• Approved logic, under change control.
• Parameters used at each run, retained with the output.
• Row count and control total at each run, with a reconciliation to source.
• Level of detail compared against the review threshold.
• ITGC coverage of both the application and the report itself.
• For service-organization data: SOC report scope and complementary user entity controls.
• A way to regenerate the report as it stood on the control date.

A system of record should let a reviewer see, for any figure in a report, which source records produced it and as of when.

Sources

1. Sarbanes-Oxley Act of 2002, Public Law 107-204 (GovInfo) - enacted text of sections 302 and 404.
2. 15 U.S.C. 7262, United States Code 2023 edition (GovInfo) - current 404(a)-(c).
3. 17 CFR 240.13a-15, Controls and procedures (eCFR) - management evaluation, framework, ICFR definition.
4. PCAOB AS 2201, An Audit of Internal Control Over Financial Reporting - paragraphs .02-.03, .39, .45, .50, .62-.70, .B29-.B30, .A5.
5. PCAOB AS 1105, Audit Evidence - paragraphs .05-.08, .10, .10A.
6. PCAOB implementation page for the technology-assisted analysis amendments (Release No. 2024-007) - scope and effective date of the AS 1105 amendments.
7. PCAOB Release No. 2025-004, Policy Statement Regarding Implementation of Paragraph .10A of AS 1105 - inspection and enforcement position on .10A(b).
8. PCAOB Staff Audit Practice Alert No. 11, Considerations for Audits of Internal Control Over Financial Reporting (2013) - system-generated data and reports in controls.
9. PCAOB Spotlight, Inspection Observations Related to Auditor Use of Data and Reports (April 2024) - IPC examples, 2021-2022 comment-form rate, deficiencies, good practices.
10. COSO, Guidance on Internal Control - Internal Control - Integrated Framework, 1992 and 2013 editions.
11. IAASB, ISA 500 Audit Evidence (2013 Handbook edition, IFAC) - "information produced by the entity" requirement in paragraph 9.
12. IAASB, Consultations: latest on our projects - exposure drafts of ISA 330, 500 and 520 (Revised), approved June 2026, comments until 15 December 2026.