Work / Financial controls / Leadership

SOX isn’t just about compliance. It’s about clear storytelling.

By John Biersmith · October 25, 2026 · 4 min read

A leadership perspective on connecting financial-reporting risk, control design, evidence, and accountability.

A control can have a name, an owner, a frequency, and a folder full of evidence—and still be difficult to explain. That should make us pause.

My view is that a strong Sarbanes-Oxley (SOX) program should make the organization easier to understand. It should explain where financial reporting could go wrong, how the business addresses those risks, and what evidence supports management’s confidence. Clear storytelling is the discipline of making that reasoning visible.

The story still has to stand up to scrutiny. A polished narrative cannot repair an ineffective control. But when the explanation is unclear, it becomes harder to identify weak design, challenge assumptions, or make good investment decisions.

Start with the financial-reporting risk

A useful control conversation begins with a business question: what could cause this part of the financial statements to be materially wrong? Starting with last year’s control inventory can make yesterday’s activities feel like today’s requirements.

The regulatory foundation matters. The SEC’s management guidance describes a top-down, risk-based evaluation of internal control over financial reporting (ICFR). PCAOB AS 2201 similarly directs the external auditor’s attention toward significant accounts, disclosures, relevant assertions, and the controls addressing assessed risks. Management’s assessment and the external audit have distinct responsibilities; they should share a clear understanding of the underlying process.^[1][2]

Consider a hypothetical subscription business introducing a new promotional offer. “The billing system changed” is too broad to guide a control response. More useful questions are whether the offer reaches all eligible transactions, whether the calculation follows the approved rules, and whether the resulting accounting reflects the intended treatment.

Those questions connect commercial decisions, technology, and financial reporting. They also help leaders distinguish the risks that need SOX coverage from other operational concerns that still deserve an owner.

Make the control’s logic explicit

A useful control description should help someone understand the decision being made. “Management reviews revenue monthly” leaves too much unanswered. Which population is reviewed? What makes a result unexpected? What happens when the reviewer finds something? When must the issue be resolved?

For a hypothetical revenue review, I would want the design to explain the expected relationship between billing activity and reported revenue, the level of detail used, the basis for investigation thresholds, and the treatment of reconciling items. The thresholds should fit the risk; a convenient round number is not a rationale.

This is where the word “review” needs substance. AS 2201 recognizes that the precision of a control affects whether it addresses a risk, and that inquiry alone is insufficient to establish control effectiveness.^[2] My practical takeaway is to make the reviewer’s judgment understandable through the work itself.

Treat evidence as a record of a decision

A screenshot can show what appeared on a screen. An approval can show that someone clicked a button. Neither necessarily explains the scope of the review or how an exception was resolved.

I organize the evidence question around three decisions: what information did the reviewer use, what did the reviewer conclude, and what action followed? That means connecting the report version, period, and parameters to the analysis and retaining the follow-up on unusual items.

The information feeding the control deserves the same attention. A well-designed review can reach the wrong conclusion if the population is incomplete or the report logic is incorrect. I would ask how the team establishes the reliability of the information used, including relevant source data, transformations, filters, and manual adjustments.

The goal is a record that a capable colleague can follow without reconstructing the process from a series of meetings. That is useful during an audit, a leadership transition, or an unexpected absence.

Give ownership practical meaning

A name in a risk and control matrix does not settle every responsibility. Finance may own the accounting conclusion, technology may operate the relevant application, and a shared service team may perform the reconciliation. A SOX team can help connect those responsibilities, but coordination should not become a substitute for business ownership.

The handoffs should be explicit: who maintains the control, who provides reliable inputs, who investigates exceptions, and who can fund a permanent fix? Where responsibilities cross teams, leaders need a route for resolving disagreement before a deadline turns it into a crisis.

Use the program to guide investment

From an executive perspective, I would want to know where recurring control effort points to a process that needs improvement. Repeated manual reconciliations may suggest unstable interfaces. Persistent evidence gaps may reflect unclear review expectations. A high volume of exceptions may warrant changing an upstream process rather than adding another downstream review.

Automation should follow that diagnosis. Automating an unclear control can reproduce the same uncertainty faster. A stronger sequence is to define the objective, assess the data and rules, decide how exceptions will be handled, and then choose the technology. An automated control still needs appropriate oversight of access, changes, processing, and failures.

I evaluate the strength of a SOX program through a combination of risk coverage, repeat issues, exception resolution, control sustainability, and the effort required from the business. A lower control count or a higher percentage of automated activities can be useful information, but neither is sufficient evidence of improvement.

The leadership opportunity

The most useful SOX conversations connect a financial-reporting exposure to a business decision. They help leaders see the tradeoffs between another manual task, an upstream fix, a technology investment, and an accepted operational constraint.

That is the kind of control environment I want to help build: one where the reasoning is clear, the evidence is credible, and responsibility is understood. A strong story makes those connections visible—and gives the organization a better basis for action.