Sarbanes Oxley 404/409: Seven Things You Need to Know About IT Controls

When sections 404 and 409 of the Sarbanes Oxley Act of 2002 were written, they were originally designed to encompass financial controls only. Kept well within the realm of the internal audit staff, the rules were designed to ensure the accuracy of the financial reporting at each month end. What the PCAOB (Public Company Accounting Oversight Board) quickly realized was that the controls that affect the month end financial reporting stretch well beyond the internal audit group and into the very operations of the organization.