Challenge #484: SOX Controls Audit Log Review

[AYXAcademy]

Hi Community members,

A solution to last week’s challenge can be found here.

This challenge was submitted by our ACE Carolyn Canterman (@Carolyn). Thank you, Carolyn for your submission!

The Sarbanes-Oxley Act of 2002 (SOX) is a U.S. federal law enacted to protect investors by improving the accuracy and reliability of corporate disclosures. Under SOX, companies must implement internal controls over financial reporting.

These controls are categorized as:

• Key Controls – considered critical for financial reporting and subject to stricter review
• Non-Key Controls – important, but with less scrutiny

Each SOX control requires:

• A Preparer, who performs the analysis.
• A Reviewer, who independently reviews the work.

Both the Preparer and Reviewer must sign off by entering their name and date. This sign-off process is logged as evidence of proper control execution.

You are an auditor reviewing the SOX Control Sign-Off Log for accuracy and compliance.

You will be provided with three input files:

1. The SOX Control Sign Off Log, evidencing the Preparer and Reviewer sign off for each Control, for two different months.
2. Information on the employees.
3. List of issues that you are checking for.

Use the Issue Rule List to validate each Control entry. A control has an issue if it violates any of the following rules:

1. Both Preparer and Reviewer must be present, and they must be different individuals.
2. Sign-off dates must follow proper sequence:
• Both Preparer and Reviewer must have a date.
• Reviewer date must be within 5 days after the Preparer date (inclusive).
• Reviewer date cannot be before the Preparer date.
3. If the SOX Control is marked as a Key Control, the Reviewer must be a manager.

Your Tasks

Task 1: For each Control in each Period, count how many issues are present according to the rules above.

Note: If information is missing or unclear and you cannot determine whether there’s an issue, do not count it as an issue.

Task 2: Which Period had more total issues — March 2025 or April 2025?

Task 3: Task 3: Across both periods, which control had the most issues in total?

Bonus Task: Which person is associated with the most total issues across all controls and periods?

Once you have completed your challenge, include your solution file and a screenshot of your workflow as attachments to your comment.

Good Luck!

The Academy Team

Download Start File

Download Solution File

[dougperez]

Here is my solution!

Spoiler

[Erin]

I was so close to responding first. Horseshoes and hand grenades. Anyways, I was two off on the bonus and I think I know why....

Spoiler

Our friend Connie had issues on the same control in both periods, and I counted both against her (sorry Connie).That's why my bonus says 10 vs 8. You can see in the results window below the control that's causing the issues - other than Connie. Poor Connie.

[alineruizcampos]

Spoiler

[Bobbyt23]

This was a fun one. I wanted to make sure I used all the input boxes and the bonus took me a couple of cracks to get right.

Spoiler

[RolandSchubert]

Spoiler

[olga_strubbe]

Thank you, @Carolyn!

This was a great challenge, and it was fun cracking it.  I did struggle some with the bonus task until I grouped the persons by period and control ID.  When not grouped in this way, it returned the same person with more issues (Connie, 10 issues)  vs. when grouped, I got the correct answer (Connie, 8 issues).  Not sure why it needed to be grouped though, thought we were looking for the person with most issues across ALL periods and control IDs.  Appreciate a helping hint here as to why. 

I also followed a similar approach as @Bobbyt23  - seemed to work in a nice and streamlined fashion for me.  

Spoiler

[Kenda]

Spoiler

[Pilsner]

Great challenge, certainly exercised my use of "If" statements!

Spoiler

 

[Carolyn]

Hey @olga_strubbe, 

A couple of things:

1. The way you and I are solving the Bonus is different. We each did a Transpose but my Key Columns were Preparer and Reviewer, whereas you did Control ID and Period. I did that so I could bring in the "At Fault" column from the list of issues to determine if it's a Preparer or Reviewer issue. See spoiler (I'm going to post my full solution in a few minutes)

Spoiler

2. The root of the difference is 

Spoiler

Control 5555 in April where Connie signed off as the Preparer & Reviewer, and she-as-the-Reviewer signed off before the Preparer. What you and @Erin are doing is counting each of those issues against her twice, once as the Preparer and once as the Reviewer.

However, it's really an issue for the Reviewer role. Connie-as-the-Preparer didn't do anything she wrong. She signed off with a date. If someone else had Reviewed it, it would have been fine. But then she screwed up by also being the Reviewer and dating it wrong. It's nitpicky, but the issue count should just hit Connie-as-the-Reviewer. 

Thinking of it another way, if the Reviewer had been someone else, that only would've counted against the someone else, not Connie. Therefore, only the Reviewer points should go to her, vs counting it against her twice. 

I could see an argument for counting it against her twice since it's a pretty serious issue in real life to Review your own Preparation, especially if it's a Key SOX Control. Either way, it tells management and Internal Audit that there's a problem with Connie's Control sign offs, so it gives management similar information whether you count it as 8 or 10