SOX Outsourcing
Definition
SOX Outsourcing
SOX outsourcing concerns how the Sarbanes-Oxley Act applies when a public company runs its financial processes through an external provider. Outsourcing a process never outsources the assertion, so management still certifies the controls that it no longer operates.
That asymmetry is the whole subject.
Your payroll runs in another company’s building, on another company’s systems, staffed by people you do not employ — and your chief executive and chief financial officer still sign a certification covering the resulting numbers.
The mechanism that bridges the gap is a service auditor’s report, and getting the right one is the practical work.
Key takeaways
- Management’s certification duties do not transfer to a provider.
- Outsourced processes affecting financial reporting remain inside the internal control assessment.
- A SOC 1 report is the standard mechanism for covering controls at a service organisation.
- Report period, exceptions and complementary controls decide whether the report is useful.
How it works
The statute is the Sarbanes-Oxley Act of 2002. Section 302 requires a company’s principal executive and financial officers to certify annual and quarterly reports, confirming they reviewed the report and that it contains no material misstatements or omissions.
Section 404 is the one that reaches outsourced operations. It requires annual reports to contain an internal control report in which management states its responsibility for internal control over financial reporting and assesses its effectiveness.
Nothing in either section excludes processes performed by somebody else — if an outsourced activity affects the numbers, its controls are inside the assessment.
That is why service auditor reports exist. The AICPA describes a SOC 1 as an examination of controls at a service organization that are likely to be relevant to user entities’ internal control over financial reporting.
The external auditor sits behind all of it. Audits of public companies are overseen by the Public Company Accounting Oversight Board, which the statute created and which exists to oversee the audits of public companies in order to protect investors.
| Outsourced process | Inside the SOX assessment? |
|---|---|
| Payroll processing | Yes, it feeds the financial statements |
| Billing and accounts receivable | Yes |
| Claims administration | Yes, where it drives recognised amounts |
| IT hosting for finance systems | Yes, through general IT controls |
| Customer support with no financial effect | Generally not |
The reporting period is the detail that derails audits — a provider’s report covering nine months of your twelve-month year leaves a gap you must address separately.
Examples
Outsourced finance processes pass audit scrutiny only when the assurance documents line up with the reporting calendar. The examples here are plain ones, and each has an uncomfortable answer attached.
A company outsources payroll and obtains a SOC 1 type 2. Its auditor relies on that report rather than testing the provider directly, which keeps audit cost down.
A firm’s finance and accounting outsourcing provider offers only a type 1 report. Design was assessed and operating effectiveness was not, so the auditor tests anyway.
A business misses that its provider’s report lists complementary controls it was expected to run. Those controls were never assigned, and the reliance was weaker than assumed.
A controller discovers the report period ends three months before year end. A bridge letter covers the gap, and it is an assertion rather than an audited conclusion.
Related terms
Financial reporting obligations, the assurance products around them and the roles involved get merged into one idea. The terms below each get a single sense, with the boundary stated rather than assumed.
- Certified public accountant (CPA): the professional who examines controls and signs the report.
- Compliance outsourcing: buying regulatory capability, which cannot absorb management’s certification.
- Finance and accounting outsourcing: the service line most often inside the assessment.
- Regulated outsourcing: sector rules that layer above securities law obligations.
- Vendor management outsourcing: running supplier assurance, including collecting reports on time.
- Risk outsourcing: transferring exposure, which certification duties resist entirely.
- Compliance officer: the role coordinating the programme, distinct from the certifying officers.
FAQ
Can SOX obligations be outsourced?
No. The process can be outsourced; the certification and the internal control assessment remain with the company’s management.
Which outsourced processes are in scope?
Any whose controls affect internal control over financial reporting, which typically includes payroll, billing, claims and finance system hosting.
What report should I ask a provider for?
A SOC 1, and normally a type 2, since it covers operating effectiveness over a period rather than design at a single date.
What if the report period does not match my year end?
You will usually need a bridge letter covering the gap. It is a management assertion from the provider, not an audited conclusion.
Who oversees the auditors?
The Public Company Accounting Oversight Board, created by the Act to oversee audits of public companies and protect investors.
Does a SOC 2 work instead?
Not for financial reporting. SOC 2 addresses security and related criteria, which is a different question from the accuracy of financial processing.
Compare verified partners in the Outsource Accelerator directory and ask which controls your provider tests and which you do.
Independent
