SOX Compliance

The Sarbanes-Oxley Act is a US federal law that requires companies listed on US stock exchanges (and other SEC-registered filers) to certify the accuracy of their financial reports and to assess — and in most cases have independently attested to — whether their internal controls over financial reporting actually work. Section 302 is the CEO/CFO's personal certification on each quarterly and annual filing. Section 404 is the broader annual assessment of internal control effectiveness, plus (for most larger filers) an independent auditor's attestation on that assessment.

SOX itself is a US law and does not directly regulate an Indian or UAE company as such. However, SOX obligations flow down to you if you are a subsidiary, branch, or shared-service centre of a US-listed parent — because the parent's consolidated financial statements and its Section 404 assessment must cover controls at every significant location, wherever it is incorporated. If your India/UAE entity's transactions and account balances are material to the US parent's consolidated statements, your location is very likely in scope for the parent's SOX programme even though your entity itself files nothing with the SEC.

No. The SOX Section 404(b) attestation opinion on internal control over financial reporting must be issued by a PCAOB-registered public accounting firm engaged directly by the US-listed parent, and the underlying management assertion is made by the parent's own CEO and CFO. PNPC's role is management-side support at the India/UAE location — documentation, self-testing, remediation, and coordination with whichever firm holds the actual attestation engagement. We are explicit about this boundary with every client so there is no ambiguity about what PNPC's engagement does and does not cover.

Section 302 is a certification requirement — the CEO and CFO personally certify, in every quarterly (10-Q) and annual (10-K) SEC filing, that they have reviewed the report, it contains no material misstatement, and they have evaluated the effectiveness of the company's disclosure controls and procedures. Section 404 is a broader, annual internal-control assessment requirement — management must include in the 10-K its own assessment of the effectiveness of internal control over financial reporting (ICFR), and, for accelerated and large accelerated filers, the external auditor must separately attest to that assessment. In practice, the year-round documentation and testing work most people mean by 'SOX compliance' is Section 404 work; Section 302 is the quarterly certification output that relies on that underlying control environment being sound.

In a typical top-down, risk-based SOX scoping approach (consistent with SEC interpretive guidance and PCAOB AS 2201), the parent's management and external auditor identify 'significant locations' based on quantitative thresholds — commonly a percentage of consolidated revenue, assets, or another relevant financial metric — and qualitative factors such as unique or higher-risk processes performed at that location, or specific fraud risk indicators. If your India or UAE entity crosses the parent's chosen threshold, or performs a process the parent's risk assessment flags as significant regardless of size, it will be designated in scope. This determination is made by the parent's management and external auditor, not by the local entity.

Process narratives and walkthrough documentation for in-scope processes; a Risk & Control Matrix (RCM) mapped to COSO 2013 components and the parent's significant accounts; test-of-design and test-of-operating-effectiveness workpapers for interim and year-end testing; a deficiency log with severity evaluation; remediation support and re-testing evidence; and direct liaison with the parent's SOX PMO and external audit team during fieldwork. The specific mix is agreed in a written scope based on what the parent's programme requires from your location.

Both address the same underlying idea — controls over financial reporting — but they are separate legal requirements with different scope, standards, and reporting lines. IFC under Section 143(3)(i) of the Companies Act 2013 requires the Indian statutory auditor to report on the adequacy and operating effectiveness of internal financial controls over financial reporting for the standalone Indian company, following ICAI's Guidance Note on Audit of ICFR. SOX Section 404 requires the US parent's management to assess, and (for applicable filers) its PCAOB-registered auditor to attest to, ICFR at the consolidated group level, which includes the India/UAE component. A company can be fully compliant with Indian IFC requirements and still have a SOX deficiency at the same location if the parent's control expectations (methodology, sample sizes, or specific control requirements) differ from the Indian statutory audit approach — the two exercises inform each other but are not interchangeable.

Not necessarily — quantitative scoping thresholds mean many smaller subsidiaries fall outside the parent's 'significant location' designation entirely, in which case detailed local SOX testing may not be required, though some baseline entity-level controls and fraud risk considerations can still apply group-wide. However, size alone is not the only factor: a smaller location can still be scoped in if it performs a qualitatively significant process (for example, if it is the sole processing centre for a specific significant account, or has unique fraud risk indicators) even below the standard revenue/asset threshold. Only the parent's scoping exercise can confirm your actual status for a given fiscal year, and it can change year to year as the group's structure and materiality shift.

It is first evaluated and classified by severity — a routine control deficiency, a significant deficiency, or (at the most serious end) a material weakness — based on the likely magnitude of potential misstatement and how likely it is to occur, following the framework in PCAOB AS 2201. Most deficiencies, correctly classified, are routine control deficiencies that get remediated within the fiscal year without any external disclosure. A significant deficiency or material weakness has a higher bar and, particularly for a material weakness, may need to be disclosed in the parent's SEC filings — which is why early identification (interim testing, not year-end) and prompt, well-documented remediation matter so much.

Once a deficiency is identified, the process owner designs a fix — a redesigned control step, an added review layer, a system configuration change, or training — with a clear implementation date. The control then needs to operate for a sufficient period, with multiple instances of operation, before a re-test can support a conclusion that it is now operating effectively; a control that has only run once cannot be concluded as reliably effective. PNPC independently re-tests the remediated control and documents evidence a subsequent external audit review will specifically look for — timestamps, approval trails, sample selections, and the rationale for concluding the deficiency is closed.

Yes, where the client wants that coordination — and in practice, most do. PNPC's engagement team is available directly to the parent's PCAOB-registered external audit team for walkthroughs, evidence requests, and query resolution during their fieldwork at your India/UAE location, working through whatever access and confidentiality protocols the parent and external auditor require. We are not the attesting firm, but we are frequently the local team the audit fieldwork staff spend the most time with.

ITGCs are the foundational controls over the IT environment — access management (who can get into financially relevant systems and what they can do once there), change management (how changes to applications and infrastructure are authorised, tested, and deployed), and IT operations (backups, job scheduling, system availability) — that underpin the reliability of the automated and IT-dependent controls built on top of them. If ITGCs are weak, an external auditor generally cannot rely on the automated controls in the application even if those controls look well-designed, because there is no assurance the underlying system and its data have not been improperly altered.

Generally 12–18 months before the anticipated listing date, and certainly well before the first Section 404 assessment becomes mandatory. Newly public companies typically get a limited transition period before the external auditor's attestation requirement applies (and non-accelerated filers/smaller reporting companies may remain exempt from the auditor attestation requirement even after listing, under Dodd-Frank), but management's own Section 404(a) assessment and Section 302 certifications apply from very early in the newly-public company's reporting cycle, and a material weakness identified in year one is a damaging, highly visible outcome for a newly listed company. Building the control framework, documentation, and testing discipline well ahead of listing avoids discovering foundational gaps under public-market scrutiny.

SOX itself does not legally apply until there is an actual SEC filing obligation. However, many US PE sponsors — particularly those planning an eventual IPO or trade sale exit, or those already managing a portfolio of SEC-registered funds with reporting obligations — impose SOX-equivalent control discipline on portfolio companies well before any formal listing, as a governance and exit-readiness requirement. In these cases, PNPC's engagement is framed explicitly as 'SOX readiness' rather than SOX compliance in the legal sense, but the documentation, testing, and remediation methodology is essentially the same.

A first-year build — process narratives, the Risk & Control Matrix, walkthroughs, and initial interim testing — typically takes 6–8 weeks of concentrated documentation work before interim testing can begin, and the full first fiscal-year cycle through year-end roll-forward testing and external audit support runs the length of the parent's fiscal year. Subsequent years are materially faster, since the baseline documentation exists and only needs refreshing for process or system changes.

Fees depend on the number of in-scope processes, the complexity of locally-managed IT systems, whether this is a first-year build or a refresh of an existing programme, and the depth of testing agreed with the parent's methodology. PNPC provides a written scope and fixed-fee proposal after reviewing the parent's scoping documentation and understanding what your location is actually expected to deliver — we do not quote a fee before seeing that.

It depends on the independence rules that apply to your specific structure, and we assess this explicitly at scoping rather than assuming it is fine. Where PNPC is also the Indian statutory auditor or otherwise has an independence-restricted relationship with the entity, we structure the SOX support engagement with appropriate separation, or advise that an independent firm should perform the work, consistent with both Indian independence requirements under the Companies Act and any independence expectations the parent's own external auditor may have regarding management-side support providers.

A walkthrough traces one or more actual transactions through the entire process — from how it is initiated, through each control point, to how it is ultimately recorded in the general ledger — confirming with the process owner, in real time, that the documented narrative and control matrix actually reflect what happens in practice. A narrative written from memory or from a policy document, without a walkthrough against a real transaction, frequently misses steps, informal workarounds, or controls that exist on paper but are not actually performed.

Yes, in a defined way. SOX Section 404 assessment and the external auditor's attestation both require consideration of fraud risk as part of evaluating internal control effectiveness — including management override of controls, a recognised heightened risk area under professional auditing standards. PNPC's control testing and RCM design specifically consider fraud risk factors relevant to the location's processes (for example, journal entry controls, segregation of duties in cash handling, and management override safeguards), though a full, standalone fraud risk assessment or investigation of a suspected specific incident is a separate, more targeted engagement.

Where the ERP is centrally managed and its ITGCs are tested at the parent or a central IT location, your India/UAE testing scope typically focuses on the application-level and manual controls performed locally on top of that system — approvals, reconciliations, review controls — rather than duplicating ITGC testing the parent's programme already covers centrally. We confirm this scoping boundary explicitly with the parent's SOX PMO to avoid either duplicated testing effort or an unintentional gap where neither team tests a control that falls in the seam between central IT and local process ownership.

We deliberately sequence and, where possible, combine evidence requests — for example, using the same underlying reconciliations, approval trails, and transaction samples to support both the Indian statutory audit's IFC procedures and the parent's SOX testing, rather than running two disconnected data-collection exercises that ask your finance team for overlapping information twice. A single coordinating point of contact on the PNPC side manages both work streams so your team is not fielding duplicate requests from different PNPC engagement teams.

The parent's PCAOB-registered external audit team typically conducts fieldwork — either on-site or remotely — reviewing the evidence package, re-performing walkthroughs, independently testing a sample of the same (or additional) controls, and raising follow-up queries. PNPC's engagement team is present to walk the auditors through our documentation, retrieve additional evidence on request, and resolve process-owner queries quickly, so fieldwork proceeds efficiently rather than stalling on document requests that take days to fulfil internally.

Potentially, yes, if the deficiency is severe enough. If a deficiency at your location is evaluated as a material weakness and is not remediated before year-end, it must generally be disclosed in the parent's Section 404 assessment and can result in management concluding that ICFR was not effective at the consolidated level — a material weakness disclosure is a serious, publicly visible event for a US-listed company, and can affect investor confidence and, in some cases, stock price. This is precisely why early interim testing, honest deficiency classification, and prompt remediation at the local level matter so much — a well-run local programme materially reduces this risk for the parent.

Yes — PNPC's Dubai office supports the same SOX documentation and testing methodology for UAE entities of US-listed parents, including Free Zone and Mainland companies. UAE Corporate Tax and VAT compliance are separate regulatory obligations from SOX, but the underlying financial processes (revenue recognition, procurement, payroll, tax provisioning) are frequently the same processes tested for both purposes, so we design a coordinated evidence set covering both where the client engages us for both scopes.

This is a common starting point, and we scope for it explicitly as a first-year build rather than assuming existing documentation to refresh. We start with process walkthroughs to understand how things actually happen today, build narratives and the Risk & Control Matrix from that ground truth, and prioritise the processes tied to the parent's most significant accounts first, so the highest-risk areas are documented and tested with enough runway left in the fiscal year, even if lower-priority processes are completed slightly later in the cycle.

We track PCAOB standard updates, SEC rule changes, and COSO framework guidance relevant to ICFR through our professional research resources and direct coordination with the US-side external auditors and SOX PMOs we work alongside on client engagements — since our engagement design has to remain consistent with whatever methodology the parent's actual attesting auditor is using. Where a specific interpretive question arises that is genuinely a matter for US securities law or PCAOB standard interpretation, we defer that specific point to the parent's US counsel or the external auditor rather than offering an opinion outside PNPC's jurisdiction of practice.

A US-based SOX consultancy's India office often applies a standardised global methodology with limited flexibility for the specific realities of Indian statutory compliance, local process nuance, or a UAE component of the same group. A Big 4 firm brings scale but frequently at a premium fee with a rotating junior team on the engagement. PNPC combines nearly four decades of hands-on Indian and UAE Chartered Accountancy practice — including the statutory audit, tax, and IFC context that SOX findings inevitably intersect with locally — with a senior-partner-led engagement model, direct availability to your finance team and the external auditor, and coordinated coverage across our Chennai, Bangalore, Hyderabad, and Dubai offices.

Scoping alignment with the parent's SOX PMO; process narrative documentation and walkthroughs for all in-scope processes; Risk & Control Matrix build or refresh mapped to COSO 2013; ITGC scoping and documentation for locally-managed systems; test-of-design evaluation; interim management self-testing of operating effectiveness; deficiency evaluation and severity classification; remediation design support and independent re-testing; year-end roll-forward testing; a complete, audit-ready evidence package; direct liaison with the parent's external audit team during fieldwork; and a post-cycle debrief with next-year planning.

The detailed process narratives, RCM, and testing workpapers PNPC prepares are internal management-support documents, shared with your finance leadership, the parent's SOX PMO, and the parent's external auditor as part of their attestation work — they are not filed with the SEC directly. What ultimately becomes public is limited to the parent's own disclosures in its 10-K/10-Q filings — principally the CEO/CFO Section 302 certifications and the Section 404 management assessment (and, where applicable, the auditor's attestation report) — which are high-level conclusions, not the underlying location-level workpapers themselves.

US securities rules classify SEC filers into categories — including large accelerated filer, accelerated filer, non-accelerated filer, and smaller reporting company — based primarily on public float and revenue thresholds set by the SEC. The classification matters because non-accelerated filers and smaller reporting companies are generally exempt, under the Dodd-Frank Act, from the requirement that the external auditor separately attest to management's ICFR assessment under Section 404(b) — management's own Section 404(a) assessment and the Section 302 certifications still apply, but the absence of the auditor attestation materially changes the scope, rigour, and cost of the local testing programme needed to support it.

The parent's Audit Committee has overall Board-level oversight of the SOX 404 programme and typically receives periodic updates on testing status, deficiencies, and remediation progress across all significant locations, usually consolidated and presented by the parent's SOX PMO or CFO rather than location by location. It is uncommon for an India/UAE location's local support team to present directly to the US parent's Audit Committee, though a material weakness or a significant, unresolved deficiency at your location can certainly become a specific agenda item the Committee discusses, sometimes with the local finance lead or PNPC engagement team dialling in to answer questions.

Yes — we build the entire testing calendar (interim testing window, remediation deadlines, roll-forward period, and external audit fieldwork support) around your specific parent company's fiscal year-end, not a generic calendar-year assumption. A parent with, for example, a June fiscal year-end needs interim testing completed well before December, with roll-forward testing and fieldwork support timed to a May/June close — a materially different internal calendar than a December year-end company, even though the underlying testing methodology is identical.