Keep your methodology
Your risk and control matrix, your processes, your sampling criteria and your own formats. You start with what you already have.
SOX software to keep your controls tested and ready for the auditor
Risk and control matrix, walkthroughs, testing, deficiencies and sub-certifications in one place. From the annual assessment of internal control (Section 404) to the certification of every report (Section 302).
4.4 · 105 reviews on G2
2,000+ companies trust GlobalSuite®
Managing SOX in GlobalSuite®
What the law requires, what you've already done and what's missing, in a single platform. Screens with sample data.
Each section of the Act with its status and level of compliance for the year, with Section 404 in view.
Each section of the Act with its status and level of compliance for the year, with Section 404 in view.
Each process in its tree, with its sub-processes, the systems it uses and who is responsible for each step.
Operating effectiveness testing for each process in the audit tool: controls tested, risks reviewed and exceptions.
Pick a risk in an in-scope system and the AI suggests IT general controls aligned with COSO. Add them to the plan and the residual risk is recalculated.
AI agent
Add to planDismiss
✓ 2 controls added to the treatment planAI technology can make mistakes.Each quarter the sub-certification follows its sign-off workflow: control owners, area directors and, last, senior management.
The Power BI dashboard for management and the audit committee, with up-to-date data.
Automate the compliance process
You set up the workflow once and GlobalSuite® repeats it: it requests, reminds, collects and updates. Your team only steps in when there's a decision to make.
- Assessment campaignsQuestionnaires sent to each control owner, with reminders until they reply.
- Tests and evidence that request themselvesEach control requests its test and evidence according to its frequency, and alerts its owner before the due date.
- Approval workflowsPolicies, accepted risks and exceptions, each with its sign-off and date.
- Everything recalculatesWhen you close a deficiency or test a control, the status of each account, the process and the indicators changes.
What you save when you drop spreadsheets
The reports are already done
Risk and control matrix, tests with their evidence and a deficiency report for the audit committee, up to date and ready to download.
AI does the first pass
Before every close, the agent goes through the control matrix, finds the controls that are untested or lack evidence and drafts the plan. You just validate it.
What you do for SOX counts towards other standards
The processes, financial reporting risks and controls you test for SOX are the foundation of SCIIF, the Spanish ICFR framework, and fit into your risk and compliance management. In GlobalSuite® you do it once and it works for all of them.
Our own estimate of how much of each standard is covered: each requirement counts in full if it is covered the same way and half if only partly. Each standard adds its own requirements.
SCIIF
COSO ERM
ISO 37301
Connected to the tools you already use
GlobalSuite® connects to your ecosystem via API. Data comes in on its own and nobody has to copy it by hand.
- Users, journal entries and reconciliationsfrom your ERP
- Users and accessfrom Active Directory
- Plan actionsin your ticketing tool
- Internal control indicatorsin Power BI or your data lake
Active Directory
Identity
Ticketing
CMDB
Power BI
Monitoring
Vulnerabilities
Data lake
Power BI
Monitoring
Vulnerabilities
Data lake
GlobalSuite® GRC PlatformModules
SOX lives in the Compliance module
And the module is part of the GRC platform. The processes, risks and controls you set up for SOX are the same ones used by SCIIF, internal audit and the rest of the group's obligations.
If you already work on SCIIF or another ICFR framework, much of the control matrix is already done.
Your goal: comply with SOX and reach every close without surprises
Your team leads the way. GlobalSuite® automates your management system and, if you need it, our consultants support you at whichever step you choose.
If you want help, our consultants are:Internal control consultantsSOX and ICFR specialists+2,000 projects
- Gap analysisYou know which accounts and processes are significant and which controls you're missing.
- ImplementationYou document the processes, carry out the walkthroughs and test each control with its evidence.
- Management system automationEvidence, approvals, reminders and indicators run on their own in GlobalSuite®.
- AssessmentYou go into management's assessment and the external auditor's review with everything ready.
Your internal control, ready for the auditorAnd every quarter and every year, without starting from scratch.
What our customers have achieved
Rail transport · 14,000+ employees
As we rolled out risk management and compliance processes, and given the size of the company and the range of its activities, we needed software that would make risk management more effective and efficient.
Diego Molero AlonsoDirector of Internal Audit, Compliance and Business Risk · Renfe
- 5,000
- trains a day under its risk management system
- 100%
- of processes with an owner who keeps their risks up to date
Verified reviews on G2
Read all 105 reviewsIntegration of compliance regulations, the catalog of standards, and risks in an integrated and coherent manner.
From day one, the onboarding process was excellent, allowing us to understand the platform really fast, thanks to their top-notch support team. The UI is clean and intuitive, making it easy to use for everyone.
It reduces tool fragmentation and centralizes all evidence, documentation, controls, and assessments in one place.
Shall we look at it with your risks and your methodology?
Request a demo
SOX FAQs
Can't find your question? Tell us about your case and we'll answer it with your situation in mind.
Tell us about your caseWhat is SOX?
The Sarbanes-Oxley Act, passed in the United States in 2002 to protect investors after a series of accounting scandals. It requires companies listed there to show that their financial reporting is reliable and that the internal control behind it works.
Who does it apply to?
Companies that file periodic reports with the SEC, including foreign private issuers. If your group is listed in the United States, its subsidiaries usually document and test their controls so the group can assess its internal control.
What do Sections 302 and 404 require?
Under Section 302, the CEO and CFO certify every annual and quarterly report, including what they know about internal control. Under Section 404, management assesses internal control over financial reporting (ICFR) every year and publishes its conclusion. Larger companies (accelerated and large accelerated filers) also need the external auditor's attestation; smaller reporting companies and emerging growth companies are exempt.
What's the difference between a significant deficiency and a material weakness?
A material weakness exists when there is a reasonable possibility that a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis. A significant deficiency is less severe, but merits the attention of those responsible for overseeing financial reporting. With a single material weakness, management cannot conclude that its internal control is effective.
Which control framework is used?
The usual choice is COSO's Internal Control Integrated Framework, 2013 edition, with its five components and 17 principles. The SEC requires a recognised framework, and COSO is the most widely used.
What happens if a false certification is signed?
Section 906 punishes anyone who knowingly signs one with fines and imprisonment. If done wilfully, up to $5 million and 20 years.
Does GlobalSuite Solutions carry out the audit?
No. The opinion on internal control comes from your external auditor. GlobalSuite® helps you have the controls, tests and evidence ready for them.
Where does your
SOX compliance stand?
Tell us what you need and we’ll show you how GlobalSuite® solves it.