The Sarbanes-Oxley Act (SOX) turns on proof. Your controls have to run every time, all year, and your auditor has to agree that you can show it. For most public companies that proof gets assembled quarter by quarter by Controllers and accounting teams, while the CEO and CFO are the ones whose names land on the SEC filing. Here's what that work actually looks like.
You're in the middle of another cycle, and the Prepared By Client (PBC) list just landed. It's longer than last year's. Buried in it is a request for the reviewer sign-off on last quarter's intercompany reconciliation in NetSuite. You know that control ran. You watched a colleague do it every month, but the evidence lives in a spreadsheet, a screenshot, and a recollection.
That gap, between knowing a control ran and being able to prove it, is where SOX compliance gets expensive. The controls are usually fine. It's the proof that piles up the hours. Any control whose evidence was thin last year earns closer scrutiny this year. NetSuite SOX compliance turns on the same question of whether the system can show a control ran on its own.
What SOX specifically asks of an accounting team
Section 302 requires the CEO and CFO to certify each periodic report and to evaluate the company's disclosure controls and procedures as of the end of the period covered. Material changes to internal control over financial reporting get disclosed.[^1]
Section 404(a) requires management to publish an annual internal control report containing its assessment of ICFR effectiveness. 404(b) requires the external auditor to attest to that assessment, which applies to accelerated and large accelerated filers.[^1][^2]
Section 409 requires rapid and current disclosure of material changes in financial condition and operations.[^3] Which is another way of saying your close cycle is a compliance matter as much as an operational one.
18 U.S.C. 1519, added by Section 802, makes altering, destroying, or falsifying a record with intent to obstruct a federal matter a criminal offense.[^3]
Underneath all of this sits the SEC requirement that generates most of the PBC list: management has to maintain evidential matter, including documentation, that reasonably supports its assessment.[^1] Your auditor then tests the design and the operating effectiveness of those controls against the same framework management used.[^4]
Design is the easy half. Evidence of operation is something that works best when it’s naturally baked into each individual task.
The commute between your control and your ledger
While most control matrices are sound on paper, costs start to accumulate in the distance between the control and the ledger.
A reconciliation performed in a workbook becomes end-user computing in the eyes of your auditor. Now there are questions about formula integrity, version history, access, and population completeness. A review control that depends on someone remembering to check on the fourth business day carries a standing question about consistent operation. A control that runs in a bolt-on platform raises one more question, which is whether that platform agrees with the general ledger. Answering that takes another reconciliation, with its own steps to document and test. At that point you are running a control to verify a control, and somewhere an internal auditor is quietly adding a row to the matrix.
Each layer between ledger and control is another layer to document, test, and explain. Native SuiteApps shorten that distance by putting internal controls in NetSuite itself. The control runs in NetSuite, on NetSuite data, and writes its history to the record the auditor already has open.
No single software solution can make a company SOX compliant, but the right solution can make the process noticeably smoother (and more accurate). Every control that generates its own evidence is one your team stops assembling by hand, and that time goes back to the analysis and judgment work you hired a senior accountant to do. The gap it closes is the manual effort between "we have a control" and "here is the evidence it operated 4,300 times without issue."
Internal controls in NetSuite that run on save
Most accounting policies are enforced by memory. Department is required on every expense account. Capital spend above the threshold codes to CIP. These rules usually live in a policy document and get enforced by whoever reviews coding at month end, assuming they have time.
Cross-Validation Rules moves those policies into NetSuite and applies them when a transaction is saved. It’s a no-code rules engine that validates transactions against field values, segment combinations, account types, amounts, and roles, all configured. With a simple point and click you can:
- Detect errors, warn the user, and flag the transaction on the CVR report after it’s been saved.
- Prevent errors from happening at all by stopping the transaction from saving.
These actions map onto the two halves of any control framework, each with its evidence attached. Detect leaves you a standing exception report. Prevent leaves you an operating history the system enforced on its own. Because CVR runs on User Event scripts inside NetSuite, the rules apply to transactions created by CSV import and by integrations, the two populations where reviewer-based enforcement is thinnest.
A rule is also easier to describe in a control narrative than a habit is.
"The system would not let them save it" is a considerably shorter walkthrough conversation than a sample of 25 coding reviews.
Authorization, delegation, and the approver who went to Portugal
Auditors often start with delegation of authority. Netgain Approvals routes approvals using tables rather than NetSuite workflows, so a Controller can adjust an approval matrix when the org chart changes without opening an IT ticket. Routing works across any NetSuite transaction type, and every approval and rejection is stored on the record.
Two details matter from an ICFR perspective. Managers can approve by email without a NetSuite license, so approver coverage stops being a licensing budget conversation. And approvals can be delegated, which gives a control a documented alternate when the primary approver is on PTO instead of a stalled queue.
Segregation of duties in NetSuite
Access and role design is usually the first thing an ICFR auditor walks, and where deficiencies show up most often. Who can create a vendor, who can pay one, and whether those are the same person.
Being straight about scope again: Netgain products do not provision roles, audit permission sets, or detect duty conflicts across your NetSuite permission structure. That is a different tool category. These products work one layer down, enforcing the separation once your role design exists and producing the evidence that it held.
Cross-Validation Rules validates by role, so a rule can restrict which roles may post to which accounts and segments. A restriction that lived in a role matrix becomes a control that fires on save.
Netgain Approvals keeps the initiator and the approver apart on every transaction type it routes.
NetClose separates preparer from reviewer on every reconciliation and close task, with distinct assignments and due dates for each. When a late journal entry moves a balance after a reconciliation was completed, NetClose flags the record as balance changed and notifies both parties, which keeps a reviewed reconciliation from quietly going stale.
Those are internal controls in NetSuite an auditor can test without asking anyone to reconstruct what happened.
The close environment: the final control frontier
NetClose puts the close inside NetSuite. Tasks carry owners, due dates, and sign-offs. Reconciliations and amortization run on their own, and flux analysis compares months, quarters, years, or NetSuite budgets. That last one is the analytical review control most teams perform in a workbook with a variance threshold and a comment column.
For close control, NetClose adds GL locking that layers onto NetSuite's native period close. You still run the NetSuite lock, because it kicks off period-end processes like intercompany netting and FX revaluation. NetClose governs who can post while a period is open, and reopening a period leaves that control intact.
On the evidence side, changes to NetClose records write to NetSuite System Notes. Submitting an item for review and completing that review each leave a snapshot. There is also a set of prebuilt reports built specifically for export to auditors, which is the population ICFR testing samples from.
NetSuite audit readiness in the subledgers where judgment lives
The accounts with the most judgment in them run on the oldest spreadsheets in the department.
- NetAsset handles fixed assets with audit-ready roll-forwards and waterfall analyses, alternate depreciation schedules for book and tax, and CIP tracking before an asset is placed in service.
- NetLease supports ASC 842, IFRS 16, and GASB 87 and 96, with modifications and terminations calculated in the system and audit reports built for external auditors. Netgain backs it with biannual SOC audits.
- NetCash automates bank reconciliation, a key control in nearly every SOX matrix, matching transactions to the GL with a trail of what matched, how, when, and what was unmatched.
- Shared Transactions generates both sides of an intercompany entry automatically, including advanced intercompany journal entries for cross-subsidiary payments.
The common thread is that the schedule, the journal entry, and the audit report all come off the same record, with no subledger-to-ledger tie-out to perform or document as a control of its own.
What NetSuite SOX compliance changes next cycle
An auditor asks how you know every capitalized item carried the right segment, and you point to a rule and its exception report. Who approved a purchase order in August gets answered off the record itself, and a request for close support turns into an export built to be exported.
The audit still happens, same with the walkthroughs. Your team's January changes though. Less of it goes to assembling evidence and more to reviewing what the system already put together, and the certification rests on controls that can demonstrate themselves. NetSuite audit readiness stops being a seasonal project, which is a better trade for everyone in the room, including the auditor.
Curious what your control matrix looks like when the controls run inside NetSuite? Book a demo.
Sources
[^1]: U.S. Securities and Exchange Commission, Management's Report on Internal Control Over Financial Reporting and Certification of Disclosure in Exchange Act Periodic Reports, Release Nos. 33-8238; 34-47986 (June 2003). https://www.sec.gov/files/rules/final/33-8238_0.htm
[^2]: U.S. Securities and Exchange Commission, Internal Control over Financial Reporting in Exchange Act Periodic Reports of Non-Accelerated Filers, Release No. 33-9142 (2010), implementing Section 404(c) as added by Section 989G of the Dodd-Frank Act. https://www.sec.gov/files/rules/final/2010/33-9142.pdf
[^3]: Sarbanes-Oxley Act of 2002, Pub. L. 107-204, 116 Stat. 745. https://www.govinfo.gov/app/details/PLAW-107publ204
[^4]: PCAOB Auditing Standard 2201, An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements. https://pcaobus.org/oversight/standards/auditing-standards/details/AS2201
.webp)
