SOX Planning Cheat Sheet: 6 Steps to Help You Strengthen Your SOX Program in 2027

A few weeks back, we shared an audit planning “cheat sheet” to help audit teams increase impact in 2027. This week, we’re helping SOX teams get a leg up on 2027 planning and execution. 

And we’re NOT going to talk about AI. 

Well, hold on — we have to talk about AI. It’s 2027. But we’ll fight it off as long as we can.

Instead, we’ll start with practical ways to strengthen key foundational aspects of SOX, including leveling up your risk assessment, rationalizing controls, and advancing SOX program maturity.

THEN we’ll talk about AI, because SOX programs must start accounting for how AI use may impact key controls — and how External Auditors can or will rely on AI-enabled testing, processes, or controls.

Before you jump in, heads up: With interim testing wrapping up, how does your experience stack up against what other teams are seeing? SIGN UP NOW for TODAY’s SOX Pulse Check webinar (3pm Eastern on Thursday, November 12, 2026), where SOX leaders John Johnson, Nalini Parameshwar, and Taylor Schwerman will share what they’re seeing, from External Audit focus areas to how shifts are impacting their overall control environments. 

And now, let’s get to it.

Step 1: Level Up Your 2027 SOX Risk Assessment

Is your SOX risk assessment keeping up with today’s volatile risk landscape? 

If we’re being honest, SOX risk assessments are often rinse-and-repeat. We do the same things year after year to plan materiality, analyze disaggregated accounts, overlay qualitative and quantitative factors, and consider prior-year scoping. 

It’s what we’ve always done.

In the modern risk environment, that approach probably isn’t cutting it.  

Every SOX risk assessment can benefit from being more dynamic. Which is why we’ve got six actionable ideas from leading SOX teams to help you do just that, from relying on forecast-driven materiality and considering qualitative factors from less familiar risk areas to proactively pushing External Audit alignment. One leader even shares his leading-practice approach to using assertion-level risk assessment to calculate materiality.

Which one or two ideas will you act on to strengthen your risk assessment?

Step 2: Take an Honest Look at SOX Program Maturity

How does your SOX program stack up against more mature, high-value SOX programs? 

The Internal Audit Collective’s first-of-its-kind SOX benchmarking survey dug into the day-to-day realities of Internal Audit teams who also shoulder SOX responsibilities. The data pointed to six key enablers that SOX teams can use to increase value and advance maturity:

1. A more proactive, collaborative approach to controls rationalization, including encouraging control owners to nominate controls to be rationalized — this made a big difference for high-maturity teams
2. An External Audit reliance strategy that actually realizes savings
3. A focus on optimizing GRC technology 
4. Foundational audit infrastructure such as a strategic plan, mission/vision statement, assurance map, post-audit exit surveys, and conformance with IIA Standards
5. Data analytics: high-value SOX teams were 2–3X more likely to use analytics than low-value teams
6. Improved audit plan alignment with the organization’s top risks

In what area(s) can your team use some improvement? In response, which enablers will your SOX team focus on developing in 2027?

Step 3: Refine Your Approach to Controls Rationalization 

Where is your SOX program bloated with operational controls, project management controls, and non-material financial reporting controls that shouldn’t be in scope? 

Every SOX program has the opportunity to reduce the number of SOX key controls. The question is whether and how often you prioritize making it happen. 

My SOX team developed nine questions that transformed our approach to rationalizing SOX controls. These questions can help you identify the controls that no longer matter. 

How many controls will you remove and reclassify as non-key in 2027?

Step 4: Start Building SOX Entity-Level Controls (ELCs) for AI

How does your SOX program need to change to account for your organization’s AI use?

We’re not necessarily talking about using AI in SOX. This is about creating or documenting new controls because the business is using AI.

Control owners are leveraging AI tools, but it’s tough to know where to look and how to begin. As one SOX leader put it, “We can’t know what’s going on across the organization all the time.” 

Fortunately, we don’t need to have all the answers to start solving the problem. Start with these actionable ideas for building ELCs for AI. 

For example, SOX leaders find that it helps to have more frequent conversations with the stakeholders holding the AI reins — for example, one leader strategically “made friends” with the CTO and PMO leader, because the CTO knows where they’re spending and the PMO knows who they’re helping.

Who will you “make friends” with to get SOX more in the loop on AI use? 

Step 5: Get More Deliberate and Strategic About AI Use in SOX

If your SOX team is using AI in its processes, are you being proactive about setting up governance, learning from other teams, and leveraging leading practices?

Wherever your team is on its AI journey, some other teams are further along. Why not experiment with their proven prompts, learn from their mistakes, and get inspired by their AI successes? 

The Internal Audit Collective is dedicated to sharing the AI resources to help you do it, including:

• Proven prompts and hands-on practice using them via our members-only AI Prompt Library and AI Office Hours, which are weekly sessions where you practice implementing and using a specific AI use case and ask prompt/agent creators questions in real time
• Practical guidance to help you get more strategic about choosing the right AI technologies for each AI use case in How to Develop Internal Audit’s Build-or-Buy AI Strategy, which helps teams match audit tasks to the right AI tool type, weigh key decision dimensions (i.e., quality, cost, skill, scope, accountability), and learn from teams who’ve built, bought, or done both

Are your AI tools (a) addressing problems worth solving and (b) fit for purpose? 

Step 6: Consider How External Audit Can or Will Rely on AI

If your organization is using AI (whether built or bought), are you proactively considering how your External Auditor can or will rely on management’s work? 

External Auditors themselves are still figuring this out, but trends are emerging and SOX leaders are sharing the insights, guidance, and expectations they’re hearing. To help get your team’s thinking on track and avoid surprises during the External Audit:

• Check out our AI Playbook for SOX Compliance, with six proven SOX use cases, insights on understanding AI’s impact on SOX compliance (e.g., internal controls, ITGCs, SOC 1 reviews, third-party risk management), and perspectives on External Audit reliance on both management’s use of AI in controls and Internal Audit’s use of AI in testing.
• Hear about SOX leaders’ first-hand experience using AI in SOX, including how they’re working with External Audit, setting up effective data privacy safeguards, and more.
• Join the Internal Audit Collective’s quarterly External Auditor feedback share roundtables, where Internal Audit and SOX teams with the same auditor compare notes, share solutions, and talk about what’s coming.

What steps will you take before year-end to help your SOX team avoid AI-related surprises?

THE LAST WORD: Time to Divide and Conquer

Taken together, these six steps may seem overwhelming. 

The good news is that you still have time. And — in most teams — you have help. 

So why not share this article with your direct reports? 

• Assign out each step, delegating some and keeping some for yourself. 
• Have each person review the resources and distill the 2–3 light bulbs that went off in their heads for each topic in the context of your SOX program. 
• Then, schedule a meeting in which the team shares their light-bulb moments and agrees on next steps. Have them tell YOU what they think you should do. This is an opportunity to coach while you’re strengthening SOX.

Lastly, keep an eye out for updates about the Internal Audit Collective’s next in-person event: SOX Summit, coming in April 2027!

‍