AI Agent for SOX Controls Testing
Every year the same controls are tested, the same evidence is requested and the same walkthroughs are rewritten from last year’s file. This agent gathers evidence for SOX 404 IT general controls and business process controls, draws samples you can reproduce, drafts walkthroughs and test results, and writes exceptions up as draft deficiencies. Testers review, control owners respond, and management and the external auditor reach their own conclusions.
What is an AI SOX compliance agent?
An AI SOX compliance agent is a governed software worker that prepares Sarbanes-Oxley Section 404 controls testing. It collects evidence for IT general and business process controls, reconciles populations, draws reproducible samples, tests each attribute, drafts walkthroughs and writes exceptions up as draft deficiencies, leaving every conclusion to testers, management and the auditor.
What it does
What it is not
The same controls and the same requests, rebuilt every year
A SOX programme runs on a fixed calendar, yet most of its hours go on mechanical work: chasing screenshots from control owners, rebuilding populations, picking samples in a spreadsheet and rewording last year’s walkthrough. The judgement the programme exists for, deciding whether a control actually works, gets whatever time is left.
Evidence requests never end
Testers send the same requests to the same control owners every quarter, then reconcile what comes back by hand.
Samples are hard to defend
A sample picked by hand in a spreadsheet cannot always be reproduced when the external auditor asks how the items were chosen.
Walkthroughs go stale
Narratives are copied forward from the prior year and stop describing the process the business actually runs today.
Reports are trusted untested
System reports used in controls are relied on without anyone checking that the population they show is complete and accurate.
The mechanical half of SOX testing, prepared for the people who sign it
Evidence
Evidence Gathered Against The Control
From systems first, then owners.
For each control in the risk and control matrix, the agent works out which evidence the test needs, reads what it can through read-only system queries and the evidence library, and sends control owners one specific request for the rest. Each item received is checked against the attribute it is supposed to prove before it is filed.
- Evidence list derived from the RCM
- Read-only queries for system data
- One targeted request per control owner
- Each item matched to a test attribute
Per control
Testing
Samples And Results You Can Reproduce
Seeded, documented, re-runnable.
Populations are reconciled to a control total, samples are drawn at the sizes your methodology sets for each control frequency, and the random seed is stored with the selection. Each sampled item is tested attribute by attribute, and a missing document is recorded as an exception, never quietly counted as a pass.
Re-runnable
Documentation
Walkthroughs And Deficiencies Drafted
Ready for review, not concluded.
Walkthrough narratives are drafted from current process documents and owner input, then compared with last year’s version so process changes stand out. Exceptions are written up as draft deficiencies with the condition, criteria, cause and affected accounts, and the severity field is left for management to complete.
Severity left open
How the AI SOX Compliance Agent runs a task
- STEP 01
Read the control matrix
The risk and control matrix is loaded with each control’s objective, frequency, owner and test attributes, together with last year’s workpapers. From these the agent works out what evidence each test needs, and which of it can be read from systems instead of requested from people.
RCM parsingPrior-year workpapers - STEP 02
Gather the evidence
System data such as user listings, change logs and journal populations is read through read-only queries, documents are collected from the evidence library, and control owners receive one consolidated request for whatever is still missing. Each item is checked against the attribute it is meant to support.
Read-only queriesEvidence libraryOwner requests - STEP 03
Reconcile and sample
Every population is reconciled to a control total from its source system before sampling, and key reports are tested for completeness and accuracy. Samples are drawn at your methodology’s size for the control frequency with the random seed stored, so anyone can re-draw exactly the same items.
Population reconciliationSeeded samplingKey report checks - STEP 04
Test and document
Each sampled item is tested attribute by attribute with its supporting document cited. Walkthrough narratives are redrafted from current process evidence and compared with last year’s version, and missing evidence is logged as an exception rather than assumed to be in order.
Attribute testingWalkthrough draftsException log - STEP 05
Hand over for sign-off
Results and draft deficiency write-ups go to the assigned tester and reviewer for approval. Severity, remediation and the conclusion on each control are recorded by people, and the finished file is exported for your SOX tool and for the external auditor to inspect.
Tester reviewReviewer sign-offAuditor package
Systems the AI SOX Compliance Agent connects to
Systems under test
Evidence and testing
Inputs, outputs and runtime
- Ingests
- Risk and control matrixSystem populations and listingsControl owner evidencePrior-year workpapersSampling methodology
- Produces
- Evidence mapped to attributesPopulation reconciliationsSeeded sample selectionsWalkthrough narrativesDraft deficiency write-ups
- Triggered by
- Quarterly testing windowInterim and year-end testingRemediation retest
- Human oversight
- Testers, management and auditors conclude
- Models
- Open-weight LLMs you host — Llama, Qwen or Mistral class
- Typical latency
- Hours per control test cycle
- Deployment
- On-premise or sovereign cloud with egress control
- Data residency
- Pre-release financial data stays in your network
Where the SOX Compliance Agent saves the most hours
User Access Reviews
Compare access listings with HR leaver and mover records and list the accounts that should have been removed or changed.
Change Management Testing
Match production changes to approved tickets and flag any deployment with no approval or with its developer as approver.
Key Report Validation
Test that a report used in a control is complete and accurate by reconciling its population back to the source system.
Journal Entry Testing
Select manual journals from the full population by your criteria and check each one for preparer, approver and support.
Walkthrough Refresh
Redraft each walkthrough narrative from this year’s evidence and show exactly where the process changed since last year.
Remediation Retesting
Retest remediated controls over the operating period your methodology requires and document whether the deficiency is closed.
AI SOX Compliance Agent vs chatbots and SaaS copilots
SOX testing is worth something only when an independent reviewer can re-perform it, so an assistant that produces confident prose without the population, the seed and the document behind each attribute adds review work instead of removing it.
| Generic chatbot | SaaS copilot | VDF AI | |
|---|---|---|---|
| Criteria | General SOX knowledge | Vendor control library | Your risk and control matrix |
| System data | Pasted extracts | Connected app only | Read-only queries, logged |
| Sample selection | Not reproducible | Tool-specific | Seeded and re-runnable |
| Missing evidence | Overlooked | Varies by product | Logged as an exception |
| Deficiency severity | Suggested freely | Suggested | Left to management |
| Evidence trail | None | Inside the vendor tool | Document cited per attribute |
| Where financial data goes | Vendor service | Vendor tenancy | Inside your own network |
Governance and controls
Management signs a report on internal control and the external auditor signs an opinion on it, so the agent is built to make that work easier to re-perform and impossible to mistake for either signature.
Read-only system access
Nothing under test can be changed
Seed and population kept
Any sample can be re-drawn
Missing evidence is an exception
Absence never counts as a pass
Severity left blank
Management classifies deficiencies
Named sign-off
Tester and reviewer recorded
Agent activity logged
Queries, drafts and exports audited
Evidence it leaves behind
What SOX teams notice after rollout
Who runs the AI SOX Compliance Agent
SOX programme manager
Starts each testing window with evidence already gathered for the system-sourced controls and owner requests consolidated, so the team spends its hours on the controls that need judgement instead of chasing screenshots.
IT audit lead
Tests access and change management controls against full listings reconciled to the source system, with every sample reproducible from its stored seed when the external auditor asks how the items were chosen.
Controller
Receives draft deficiency write-ups that state the condition, the affected accounts and the evidence with severity left open, which makes the classification discussion with the audit committee quicker and better informed.
Questions about the AI SOX Compliance Agent
What is an AI SOX compliance agent?
It is an agent that prepares the work behind SOX 404 controls testing: gathering evidence for IT general controls and business process controls, reconciling populations, drawing reproducible samples, testing attributes, drafting walkthroughs and writing exceptions up as draft deficiencies for testers and management to review.
How is an AI SOX compliance agent different from a generic chatbot?
A chatbot can explain what SOX requires. This agent works through your own risk and control matrix, reads your systems through read-only queries, keeps the evidence for every tested attribute, and stops short of every conclusion, which stays with the tester, management and the external auditor.
Can an AI SOX compliance agent run on-premise on SOX evidence data?
Yes. SOX evidence includes financial data before it is published, user access lists and system configurations, and keeping it on infrastructure you control avoids adding an outside AI service to the scope of the very controls you are testing.
What does an AI SOX compliance agent produce, and in what format?
Evidence files mapped to test attributes; population reconciliations; sample selections with their seeds; attribute-level test results; walkthrough narratives with year-on-year changes marked; and draft deficiency write-ups, exported as Excel and Word files for your SOX tool.
Where does an AI SOX compliance agent fit in a governed AI programme?
It prepares; people conclude. Whether a control operates effectively, how severe a deficiency is and what management asserts about internal control are human judgements, and the auditor’s opinion belongs to the auditor. Wider internal audit work belongs to the internal audit agent.
What does SOX Section 404 require?
Section 404(a) requires the management of a US public company to assess and report each year on the effectiveness of its internal control over financial reporting. Section 404(b) adds an attestation by the external auditor for accelerated and large accelerated filers, performed under PCAOB AS 2201. Most companies assess against the COSO 2013 Internal Control framework, guided by the SEC’s 2007 interpretive guidance for management.
Is the SEC changing who needs a 404(b) auditor attestation?
It has proposed to. In May 2026 the SEC proposed raising the large accelerated filer threshold from $700 million to $2 billion of public float and exempting all non-accelerated filers from the auditor attestation (Release No. 33-11419; the comment period closed on 20 July 2026). Management’s own 404(a) assessment would stay. Check the SEC’s rulemaking page for the current status before relying on it.
Can the external auditor rely on testing the agent prepares?
That is the auditor’s decision. AS 2201 lets the auditor use the work of others, such as internal audit or management testers, after assessing their competence and objectivity, and separate PCAOB amendments on technology-assisted analysis apply to audits of fiscal years beginning on or after 15 December 2025. Seeded samples, reconciled populations and cited evidence make testing easier to evaluate and re-perform.
How is this different from the AI Internal Audit Agent?
The internal audit agent works across the whole audit plan, testing full populations against any audit programme from payments to procurement. This agent is built around the SOX calendar and its artefacts: the risk and control matrix, ITGC and process controls, sampling by control frequency, walkthroughs, key report testing and deficiency write-ups prepared for management and the external auditor.
Does it decide whether a deficiency is a material weakness?
No. It documents the facts of each exception: the condition found, the criteria, the cause where known and the accounts affected. Classifying a deficiency as a control deficiency, a significant deficiency or a material weakness takes judgement about magnitude, likelihood and compensating controls, so that field is left for management, and the external auditor forms its own view. This page is not legal or audit advice.
Spend the SOX cycle on judgement, not screenshots
See the AI SOX Compliance Agent prepare an ITGC test with evidence, a sample and draft results.