A “How-To” Course on the Fundamentals of SOX compliance
Providing a modern foundation for staff, seniors, and managers to perform their SOX work.
With a baseline understanding of the regulatory environment of SOX compliance.
Understand why controls are considered key and non-key.
Appropriately evaluate the design of controls.
Perform and document walkthroughs that help control owners and appease external auditors.
Create control test attributes with more precision.
Improve their approach to dealing with key reports and IPEs.
Improve the use of their controls technology solution.
Decrease time spent on SOX and spend more time on more value-added activities.
What You Get
Register for SOX Base Camp
2025 SOX Basecamp
Practical Training for SOX Professionals Who Want to Lead.
Register for SOX Base CampSOX Compliance in 2025
Description
SOX compliance is no longer just about checking the box—it’s about adding value while managing evolving expectations from regulators, external auditors, and executive leadership. This session sets the stage for SOX Basecamp, providing a high-level overview of the current SOX compliance landscape, key regulatory updates, and industry trends shaping how leading-edge teams operate today.
Learning Objectives
The state of SOX compliance in 2025 – PCAOB focus areas, SEC regulatory updates, and audit firm inspection trends.
How companies are shifting from reactive compliance to proactive risk management.
Understanding the external auditor’s mindset – What’s driving increased scrutiny in SOX testing?
In-Depth — SOX Compliance in 2025
Description
Building on Session 1, this discussion-based session dives deeper into how organizations are adapting their SOX programs to meet today’s challenges. Participants will engage in roundtable discussions to examine:
Learning Objectives
The biggest pain points in SOX compliance today – And what leading companies are doing about them.
How external auditors approach SOX testing – Aligning internal efforts for efficiency and reducing friction.
Develop strategies to ensure IT components are properly considered in the SOX scope.
Roles and responsibilities in SOX – What the COSO Framework says about responsibilities and how the Three Lines of Defense model structures risk management.
The Regulatory Ecosystem of SOX Compliance
Description
Many SOX professionals understand the testing process but lack insight into why they are testing certain controls and how regulatory expectations shape their work. This session provides a foundational understanding of the regulatory ecosystem that governs SOX compliance. Key topics include:
Learning Objectives
The role of Congress, the SEC, and the PCAOB in SOX compliance.
How PCAOB inspection findings impact external audit firms—and, in turn, internal SOX programs.
How regulatory focus areas influence documentation, scope, and evidence.
Common regulatory misconceptions that lead to inefficiencies in SOX testing
In-Depth — The Regulatory Ecosystem of SOX Compliance
Description
This session takes a deeper dive into how regulatory oversight translates into day-to-day SOX compliance work. Participants will engage in roundtable discussions, sharing experiences and insights on topics such as:
Learning Objectives
How PCAOB inspection findings affect control testing and documentation expectations.
How SOX teams can preemptively address external auditor concerns to avoid rework.
The increasing regulatory focus on data-driven control validation and automation.
Strategies for balancing risk-based testing with regulatory compliance requirements.
Risk Assessment | Key Concepts
Description
At the core of any effective SOX program is a strong risk assessment process—yet many teams inherit a Risk and Control Matrix (RCM) rather than truly understanding how and why certain risks and controls were included. This session provides a structured approach to understanding:
Learning Objectives
Why risk assessment matters in SOX compliance.
The difference between inherent risk and control risk.
How to properly classify risks and align them to internal controls.
Common pitfalls in risk assessment—and how to avoid them.
In-Depth — Risk Assessment | Key Concepts
Description
Building on Session 05, this discussion-based session will allow participants to explore real-world risk assessment challenges and share strategies for improvement. Topics include:
Learning Objectives
How risk assessment decisions impact control scope and testing procedures.
Elements of a top-down, risk-based approach.
Strategies for updating an outdated RCM to reflect current risks.
How external auditors evaluate risk assessment quality—and what they expect to see.
Risk Assessment | Process Understanding
Description
Risk assessment is not just a one-time exercise—it should evolve as business processes change. However, many SOX professionals lack visibility into how business processes work at a detailed level, leading to control gaps, misaligned testing procedures, and audit inefficiencies. This session will cover:
Learning Objectives
How to link business processes to SOX controls effectively.
Identifying process-level risks that require SOX controls.
The role of process owners in ensuring accurate risk identification.
Common process breakdowns that lead to control failures.
In-Depth — Risk Assessment | Process Understanding
Description
Building on Session 07, this discussion-based session focuses on real-world applications of process risk assessments. Topics include:
Learning Objectives
Why many SOX programs fail to keep up with process changes.
The disconnect between process documentation and control testing—and how to fix it.
How process complexity affects control reliance and external auditor testing.
Best practices for engaging process owners in risk assessment.
Control Design (Includes IPE)
Description
A well-designed control is the foundation of effective SOX compliance. However, many controls lack clarity, are difficult to test, or fail to fully mitigate risk. This session focuses on the fundamentals of strong control design, including:
Learning Objectives
The components of an effective SOX control.
How to design controls that are precise, well-documented, and testable.
The impact of IPE on control reliability.
Why some controls fail in audits and PCAOB inspections.
In-Depth — Control Design (Includes IPE)
Description
Building on Session 09, this discussion-based session focuses on common challenges in control design and how to improve them. Topics include:
Learning Objectives
Why external auditors challenge SOX controls—and how to address their concerns.
The role of IPE in control design and why it’s a frequent source of deficiencies.
Evaluating whether controls are designed effectively to mitigate risk.
Case studies of control failures—what went wrong and how to fix it.
Testing Controls & Evaluating Deficiencies
Description
Effective control testing is critical to ensuring compliance and reducing audit risk, yet many SOX teams struggle with unclear documentation and inconsistent evaluation of deficiencies. This session will cover:
Learning Objectives
Types of SOX control testing (walkthroughs, sample-based, full population).
What external auditors expect to see in control testing documentation.
Common mistakes in deficiency evaluation—and how to avoid them.
How to assess whether a deficiency is a significant deficiency or material weakness.
In-Depth — Testing Controls & Evaluating Deficiencies
Description
This session builds on Session 11, providing a collaborative discussion on how to improve SOX control testing and deficiency evaluation. Topics include:
Learning Objectives
How to properly document test results to meet company and external auditor expectations.
Addressing common testing pitfalls, such as insufficient evidence or unclear conclusions.
Interpreting control failures and their potential impact on financial reporting.
Case study analysis—evaluating real-world control deficiencies and how they were resolved.
Optimizing the Use of Your Purpose-Built GRC Application
Description
Many organizations use GRC tools, but few maximize their potential. This session provides a practical guide to optimizing the use of GRC applications to improve SOX efficiency. Topics include:
Learning Objectives
How GRC platforms can centralize SOX documentation and testing.
Automation opportunities for control testing and deficiency tracking.
Integrating SOX compliance with enterprise risk management (ERM).
Overcoming implementation challenges and getting buy-in from stakeholders.
In-Depth — Optimizing the Use of Your Purpose-Built GRC Application
Description
This session builds on Session 13, providing a practical discussion on how to maximize the value of GRC platforms in SOX compliance. Topics include:
Learning Objectives
What features of GRC applications are underutilized—and how to leverage them.
Common integration challenges between SOX teams and IT departments.
How automation can streamline testing, documentation, and reporting.
Lessons learned from successful (and unsuccessful) GRC implementations.
The Pillars of a Modern Strategic SOX Program
Description
This session focuses on what sets high-performing SOX teams apart. Instead of simply ensuring compliance, leading SOX teams provide strategic value by integrating SOX with risk management, process improvement, and financial governance. Topics include:
Learning Objectives
What a modern SOX function looks like—beyond check-the-box compliance.
Aligning SOX compliance with enterprise risk management (ERM).
Metrics for evaluating SOX program effectiveness.
How to communicate the value of SOX compliance to executive leadership.
In-Depth — The Pillars of a Modern Strategic SOX Program
Description
Building on Session 15, this discussion will explore how organizations can move beyond compliance-driven SOX programs. Topics include:
Learning Objectives
How to make SOX more than just a compliance function.
Common roadblocks to strategic SOX transformation—and how to overcome them.
Case studies of SOX teams that successfully evolved their programs.
How to gain executive buy-in for a more strategic SOX approach.
Ryan Godbey
Ryan Godbey is a leading authority on SOX 404 and internal controls, bringing over 25 years of audit and advisory experience—including as a former national office Audit Partner at KPMG. He has worked with organizations across a wide range of industries, transforming financial reporting processes, strengthening internal controls, and ensuring compliance in complex regulatory environments.
At KPMG’s national office, Ryan was instrumental in shaping audit methodology, driving regulatory responses, and standardizing audit approaches to enhance quality and efficiency across engagements. His deep understanding of how regulators and external auditors assess SOX compliance enables him to design practical, risk-based control frameworks that not only withstand scrutiny but also improve financial governance and operational performance.
Ryan partners with CFOs, finance teams, and internal audit leaders to build scalable, technology-enabled control systems that drive efficiency and embed compliance into daily operations—rather than treating it as a standalone obligation. His approach is direct, pragmatic, and focused on creating sustainable value beyond compliance.
A trusted voice in governance and financial oversight, Ryan advises boards and audit committees while leading training and thought leadership that empowers organizations to take full ownership of their risk assessment, control design, and monitoring.
Outside of client work, Ryan enjoys playing tennis and spending time with his family.
How the course works
length
schedule
(Monday to Thursday)
Timing
Duration
Starts
.svg)
Ends
Synergy is not for everyone
Register for SOX Base CampYou are a good fit for this course if:
If you have never been trained on the fundamentals and best practices of SOX compliance, performing walkthroughs, creating testing attributes, and documenting controls.
If your SOX compliance program methodology is not keeping pace with the increasing expectations and needs of your external auditors.
If your company struggles with control deficiencies, working with control owners, or having a silo’d SOX function.
You are not a good fit for this course if:
Internal Auditors without SOX responsibilities (Internal Audit Foundations would be more suitable)
Internal Controls Leaders (The SOX Accelerator Program is more suitable for leaders)
You are not respectful, or quickly dismissive of new ideas, practices or concepts.
Register for SOX Base Camp
This course is only available for Internal Audit Collective members
8 expert Instructor-led sessions
8 facilitated workshops and peer discussions
Syllabus with all shared presentations and templates
BONUS 12 month access to the Internal Audit Collective Community
Frequently Asked Questions
Who is this course for?
- If you have never been trained on the fundamentals and best practices of SOX compliance, performing walkthroughs, creating testing attributes, and documenting controls.
- If your SOX compliance program methodology is not keeping pace with the increasing expectations and needs of your external auditors.
- If your company struggles with control deficiencies, working with control owners, or having a silo’d SOX function.
Who are you? And what is the Internal Audit Collective?
Hi - I’m Tom O’Reilly. I help internal audit and SOX professionals uplevel their programs and careers.You can read more about my backstory and why I built the Internal Audit Collective here.
What if I cannot attend all of the meetings?
You will receive CPE credits for all sessions that you attend.
You will receive a certificate of completion for participating in 80% of the meetings (13 total)
OK - I’m sold. What happens after I pay for the course?
Once you are registered, you will receive a welcome email, which will include the program syllabus with meeting information and materials. You will be asked to choose what breakout sessions you’d like to attend (7 total). You’ll then receive meeting invites.
What do I do if I have any additional questions?
Email me at: Tom@InternalAuditCollective.com - and I’ll get back to you asap.