Help us improve
Share bugs, ideas, or general feedback.
From everything-claude-finance
> Internal controls over financial reporting — Section 302/404, COSO framework, control testing, deficiency classification.
npx claudepluginhub brainbytes-dev/everything-claude-financeHow this skill is triggered — by the user, by Claude, or both
Slash command
/everything-claude-finance:sox-complianceThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
> Internal controls over financial reporting — Section 302/404, COSO framework, control testing, deficiency classification.
Provides UI/UX resources: 50+ styles, color palettes, font pairings, guidelines, charts for web/mobile across React, Next.js, Vue, Svelte, Tailwind, React Native, Flutter. Aids planning, building, reviewing interfaces.
Fetches up-to-date documentation from Context7 for libraries and frameworks like React, Next.js, Prisma. Use for setup questions, API references, and code examples.
Explores codebases via GitNexus: discover repos, query execution flows, trace processes, inspect symbol callers/callees, and review architecture.
Share bugs, ideas, or general feedback.
Internal controls over financial reporting — Section 302/404, COSO framework, control testing, deficiency classification.
Section 302 — Corporate Responsibility for Financial Reports:
Section 404(a) — Management Assessment:
Section 404(b) — Auditor Attestation:
Section 906 — Criminal Penalties:
Five Components:
Control Environment — The tone at the top
Risk Assessment — Identifying and analyzing risks
Control Activities — Policies and procedures that address risks
Information and Communication — Relevant, quality information flows
Monitoring Activities — Ongoing and separate evaluations
All 5 components and 17 principles must be present and functioning for ICFR to be effective.
Top-down risk-based approach:
Entity-level controls (ELCs): Controls at the organizational level (governance, tone at the top, risk assessment, monitoring). Can be direct or indirect. Strong ELCs may reduce testing of process-level controls.
Significant accounts and disclosures: Identify financial statement line items with material misstatement risk. Consider: size, composition, susceptibility to misstatement, volume, complexity, exposure to fraud.
Significant processes: Map significant accounts to underlying business processes and IT systems.
Key controls: Identify controls that address the risk of material misstatement. Not all controls — only those that are key to preventing or detecting material misstatement.
Locations/business units: Multi-location scoping based on financial significance (typically: cover locations representing > 60-70% of consolidated financial metric).
| Type | Description | Examples |
|---|---|---|
| Preventive | Prevents errors/fraud before they occur | Segregation of duties, authorization limits, input validations |
| Detective | Identifies errors/fraud after they occur | Reconciliations, variance analysis, exception reports |
| Manual | Performed by a person | Management review, manual reconciliation, physical count |
| Automated (ITAC) | Performed by IT system | Three-way match, automated calculations, system access controls |
| IT General Controls (ITGCs) | Support reliable automated controls | Change management, access security, computer operations, program development |
Control Deficiency: Design or operation of a control does not allow management or employees to prevent or detect misstatements on a timely basis.
Significant Deficiency: A deficiency or combination of deficiencies that is less severe than a material weakness, yet important enough to merit attention by those responsible for oversight.
Material Weakness: A deficiency or combination of deficiencies such that there is a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis. If a material weakness exists, ICFR cannot be deemed effective.
Evaluation factors:
Design Effectiveness:
Operating Effectiveness — sample sizes:
| Control frequency | Minimum sample size |
|---|---|
| Annual | 1 |
| Quarterly | 2 |
| Monthly | 2-5 |
| Weekly | 5-15 |
| Daily | 20-40 |
| Multiple per day | 25-60 |
For automated controls: Test once per period (after confirming ITGCs are effective for change management and access).
Process: _______________ Significant Account: _______________
Risk ID Risk/Assertion Control ID Control Description Type Frequency Owner Test Result
R-001 Completeness C-001 ___________________ Prev/Det Daily __________ Pass/Fail
R-002 Valuation C-002 ___________________ Prev/Det Monthly __________ Pass/Fail
R-003 Existence C-003 ___________________ Prev/Det Quarterly __________ Pass/Fail
R-004 Fraud risk C-004 ___________________ Prev/Det _________ __________ Pass/Fail
Deficiency ID: _______________
Control: _______________
Description of deficiency: _______________
Magnitude assessment:
Account balance affected: € _______________
Maximum potential misstatement: € _______________
Materiality threshold: € _______________
Likelihood assessment:
[ ] Remote [ ] Reasonably possible [ ] Probable
Compensating controls: _______________
Aggregation with other deficiencies: _______________
Classification:
[ ] Control deficiency [ ] Significant deficiency [ ] Material weakness
Remediation plan: _______________
Owner: _______________ Target date: _______________