Starter contract

sox_control_test

34 rules · plain YAML · starts in observation mode

OpenDQV Cloud starter template (v0.1) — your tenant inherits this baseline. First customer edit creates v1.0 in your audit trail; pin by yaml_hash for replay. Sarbanes-Oxley Act 2002, Sections 302 and 404 — 15 USC 7262, Internal Control over Financial Reporting (ICFR) test record compliance contract. Public companies must maintain and test internal controls under SOX Section 404. External auditors assess ICFR effectiveness per PCAOB Auditing Standard 2201. This contract enforces completeness at the point of write: control identification, COSO category, financial assertion, test methodology, result, and a cascading deficiency classification and remediation workflow. The omission failure mode: a control test record is written without deficiency classification or remediation plan. A material weakness goes unclassified. The external auditor issues an adverse ICFR opinion. CEO and CFO face personal certification liability under Section 302 and potential criminal charges under Section 906 (up to $5M fine, 20 years imprisonment for false certification).

These are starting points you own. Every rule below ships in the trial, starts in observation mode, and is yours to read, edit, or delete from day one. Rules that reference a lookup list (lookup_file) validate against reference data you control in your tenant.
Rules as at 29 August 2026 — starting points you own, not a maintained regulatory feed. We correct errors in these samples; tracking regulatory change in your active contracts is yours.

Rule	Field	Severity	What it enforces (the message your team sees)
control_id_required	control_id	error	control_id is required — every internal control must be uniquely identifiable for SOX 404 testing and tracking
control_id_unique	control_id	error	control_id must be unique within this batch — duplicate control IDs compromise the completeness of ICFR testing per PCAOB AS 2201. Note: OpenDQV validates uniqueness within the input payload only; cross-batch uniqueness against the issuer's control register is the responsibility of the upstream system.
control_name_required	control_name	error	control_name is required — a descriptive name is needed to identify the control being tested
control_owner_required	control_owner	error	control_owner is required — COSO framework requires clear assignment of control ownership and accountability
control_objective_required	control_objective	error	control_objective is required — document what risk the control is designed to mitigate per PCAOB AS 2201
control_category_required	control_category	error	control_category is required — classify the control per the COSO Integrated Framework components
control_category_valid	control_category	error	control_category must be one of the COSO framework components: control_environment, risk_assessment, control_activities, information_and_communication, monitoring
financial_assertion_required	financial_assertion	error	financial_assertion is required — PCAOB AS 2201 requires mapping each control to a financial statement assertion
financial_assertion_valid	financial_assertion	error	financial_assertion must be one of the PCAOB assertions: existence_or_occurrence, completeness, valuation_or_allocation, rights_and_obligations, presentation_and_disclosure
fiscal_period_end_required	fiscal_period_end	error	fiscal_period_end is required — SOX 404 testing is performed for a specific fiscal period
fiscal_period_end_format	fiscal_period_end	error	fiscal_period_end must be a valid date (YYYY-MM-DD)
test_date_required	test_date	error	test_date is required — record when the control test was performed per PCAOB AS 2201
test_date_format	test_date	error	test_date must be a valid date (YYYY-MM-DD)
test_type_required	test_type	error	test_type is required — PCAOB AS 2201 requires the nature of testing procedures to be documented
test_type_valid	test_type	error	test_type must be one of: inquiry, observation, inspection_of_documents, reperformance — per PCAOB AS 2201 testing procedures
test_result_required	test_result	error	test_result is required — record the outcome of the control test per PCAOB AS 2201
test_result_valid	test_result	error	test_result must be one of: effective, ineffective, not_tested
deficiency_classification_required_if_ineffective	deficiency_classification	error	deficiency_classification is required when test_result is ineffective — PCAOB AS 2201 requires all control deficiencies to be classified
deficiency_classification_valid	deficiency_classification	error	deficiency_classification must be one of: control_deficiency, significant_deficiency, material_weakness — per PCAOB AS 2201
remediation_plan_required_if_significant	remediation_plan	error	remediation_plan is required when deficiency_classification is significant_deficiency — significant deficiencies require documented remediation per PCAOB AS 2201
remediation_plan_required_if_material	remediation_plan	error	remediation_plan is required when deficiency_classification is material_weakness — material weaknesses require immediate documented remediation per PCAOB AS 2201
remediation_target_date_required_if_significant	remediation_target_date	error	remediation_target_date is required when deficiency_classification is significant_deficiency — a target remediation date must be set
remediation_target_date_required_if_material	remediation_target_date	error	remediation_target_date is required when deficiency_classification is material_weakness — a target remediation date must be set
remediation_target_date_format	remediation_target_date	error	remediation_target_date must be a valid date (YYYY-MM-DD)
remediation_owner_required_if_significant	remediation_owner	error	remediation_owner is required when deficiency_classification is significant_deficiency — assign accountability for remediation
remediation_owner_required_if_material	remediation_owner	error	remediation_owner is required when deficiency_classification is material_weakness — assign accountability for remediation
escalated_to_audit_committee_required_if_material	escalated_to_audit_committee	error	escalated_to_audit_committee is required when deficiency_classification is material_weakness — SOX 302 requires material weaknesses to be disclosed to the audit committee
escalated_to_audit_committee_valid	escalated_to_audit_committee	error	escalated_to_audit_committee must be 'true' or 'false'
management_assertion_by_required	management_assertion_by	error	management_assertion_by is required — SOX 302 requires CEO and CFO to certify ICFR effectiveness; record who made the management assertion
assertion_date_required	assertion_date	error	assertion_date is required — record the date of the management assertion per SOX 302
assertion_date_format	assertion_date	error	assertion_date must be a valid date (YYYY-MM-DD)
reviewed_by_required	reviewed_by	error	reviewed_by is required — record who reviewed this control test record for SOX 404 compliance
review_date_required	review_date	error	review_date is required
review_date_format	review_date	error	review_date must be a valid date (YYYY-MM-DD)

Run your own data against this contract in the free trial — drop a CSV in the dashboard, no code, no credit card. Start free trial →