Section 404 of the Sarbanes-Oxley Act (SOX) requires a company’s management to: evaluate the internal controls over financial reporting, conclude as to the integrity of information provided in the financial statements, conduct a timely assessment of financial reporting controls and procedures, and document those evaluations for external auditor attestation. Management is required to file an internal control report with its annual report.

This document outlines the steps management utilizes in determining the final process criticality that is the primary factor in setting the scope of the assessment.