SOX readiness conversations often jump straight into transaction controls. COSO’s entity-level principles still matter: tone from the board, integrity in reporting incentives, and competence of people who authorize unusual entries.
In practice, we ask for audit committee minutes that show challenge of significant estimates, conflict-of-interest declarations for key finance roles, and a clear path for whistleblower concerns related to financial reporting.
Segregation of duties in smaller Taiwan finance teams is a genuine constraint. Document compensating reviews instead of pretending a three-person close team can split every incompatible duty. Auditors accept compensating controls when the review is timely and evidenced.
Training records for new controllers belong in the entity-level pack. A control matrix without people context reads as incomplete.