The SOX Lifecycle Series · Book 1

The SOX Compliance Handbook, 2026 Edition

A Practitioner’s Guide to Building, Testing and Defending ICFR

Front cover of The SOX Compliance Handbook, 2026 Edition

Book 1 of The SOX Lifecycle Series

What it solves

Most SOX programmes do not fail on testing. They fail on scoping, on evidence, and on the unwillingness to call a deficiency what it is.

This handbook is an operating manual for the person accountable for the programme. It walks the thirteen-stage SOX lifecycle in order and sets out, for each stage, what to produce, what to document and what will be challenged.

Every regulatory statement is checked against a primary source and cited by PCAOB paragraph or SEC release number, so you can verify it yourself. Proposed rules and common-practice conventions are labelled as such wherever they appear. Regulatory positions are stated as of 4 August 2026.

  • Twenty chapters · Seven appendices
  • 2026 Edition · Published 4 August 2026
  • PDF direct · Kindle · Paperback

Who it’s for

Written for the person who has to make a Sarbanes-Oxley programme work:

  • The Controller at a company that has just listed
  • The Head of Finance at a business preparing for an IPO
  • The SOX Programme Manager preparing for a first integrated audit
  • The Internal Audit Manager who has inherited a programme that was never properly built

It assumes you understand financial reporting. It does not assume you have run a SOX programme before.

Contents overview

Part I · Foundations

  1. Why SOX Exists and Why It Applies to You
  2. The Language of SOX
  3. Roles and Responsibilities

Part II · Execution

  1. The SOX Compliance Lifecycle
  2. Planning and Scoping
  3. Entity-Level Controls
  4. Risk Assessment
  5. Control Identification and the RCM
  6. ITGC Scoping and Identification
  7. Narratives, Flowcharts and Process Maps
  8. Walkthroughs — Test of Design
  9. Sample Selection
  10. Test of Operating Effectiveness
  11. When a Control Fails
  12. Remediation
  13. Management’s Assessment under §404(a)
  14. Supporting the External Audit under §404(b)

Part III · Working with Auditors

  1. What Your Auditors Actually Expect

Part IV · Getting Started

  1. Your First 90 Days
  2. The Annual SOX Calendar

Appendices

  1. Glossary
  2. RCM Field Dictionary
  3. Sample Size and Population — Quick Reference
  4. Deficiency Severity Matrix
  5. Scoping Memo — Outline
  6. Auditor PBC Checklist
  7. About Ditton Advisory

Also inside: What Changed for 2026 — the SEC’s filer-status proposal and the PCAOB standards and amendments that take effect on 15 December 2026.

Sample pages

Sample page: What Changed for 2026
Sample page: Chapter 14 — When a Control Fails
Sample page: Chapter 15 — sufficient period of operation

Release list

Hear about new editions and Book 2

We’ll email you when a new edition or the next book in The SOX Lifecycle Series is released.