The SOX lifecycle, stage by stage.

Determine filer status and materiality, identify significant accounts and disclosures, map them to processes and locations, and document the scoping rationale.

Assess the control environment, oversight, risk assessment and period-end financial reporting process.

For each in-scope process, identify what could go wrong and map risks to relevant financial statement assertions.

Identify the key control for each risk and document its attributes: owner, type, nature, frequency and evidence.

Identify in-scope systems and the IT general controls they depend on. (Ditton does not perform ITGC testing; that sits with your IT audit function or a specialist provider.)

Process narratives, test procedures and walkthrough packages.

Trace transactions end to end; confirm controls exist and are designed to address the risk.

Define populations and select samples with documented rationale.

Execute tests, evaluate evidence, document conclusions and exceptions.

Classify exceptions as control deficiencies, significant deficiencies or material weaknesses, considering aggregation and compensating controls.

Root cause, action, owner, target date, and validation through re-testing.

Management concludes on ICFR effectiveness, supporting the Section 302 certifications and the Section 404(a) management report.

Support auditor fieldwork where applicable, respond to requests, archive workpapers.