Indian subsidiaries of US-listed parents, companies with institutional or private equity investors, and businesses on a path to a public listing all face a common question: do the internal controls over financial reporting hold up to independent testing? At N D Savla & Associates, our SOX Audit & Compliance service builds and tests internal financial controls aligned with the Sarbanes-Oxley Act, 2002 (SOX) and India's structural equivalent — Internal Financial Controls (ICFR) reporting under Section 143(3)(i) of the Companies Act, 2013.
Even companies with no direct US listing requirement increasingly need SOX-aligned controls: US parent companies expect their Indian subsidiaries to comply as part of group-wide SOX certification, and institutional investors ahead of a fundraise or IPO increasingly want controls documentation that goes well beyond the statutory minimum. This work is closely connected to our Corporate Governance advisory.
What Does SOX Audit & Compliance Involve?
SOX compliance work centres on internal controls over financial reporting (ICFR) — the processes that ensure financial statements are accurate and free from material misstatement, whether from error or fraud. Our services cover:
- Control environment documentation — mapping key financial processes and the controls embedded within them
- Risk and control matrix (RCM) development, linking each control to a relevant financial statement assertion
- Design effectiveness testing — confirming a control is actually designed to prevent or detect material misstatement
- Operating effectiveness testing — sampling transactions to confirm controls function as documented in practice
- Deficiency identification and remediation planning for any gaps found during testing
- Management certification support, preparing documentation needed for CEO/CFO sign-off on internal controls
Who Needs SOX-Aligned Compliance Services?
Indian Subsidiaries of US-Listed Parents
Typically must comply with group-wide SOX certification requirements, since the US parent's auditors need assurance over material subsidiaries.
Companies Preparing for a US Listing or ADR Programme
Need SOX-compliant controls in place well before the listing process begins.
Companies with Institutional or PE Investors
Increasingly expected to operate SOX-grade controls even without a formal listing requirement.
Companies Preparing for an Indian IPO
SOX-aligned testing strengthens investor confidence beyond the statutory ICFR minimum.
Historical Context: How SOX and India's ICFR Requirements Emerged
The Sarbanes-Oxley Act was enacted in the United States in 2002, following major corporate accounting scandals including Enron and WorldCom, which exposed how weak internal controls and inadequate auditor independence had allowed material financial misstatements to go undetected for years. India introduced its own parallel requirement through the Companies Act, 2013, which under Section 143(3)(i) requires statutory auditors to report on the adequacy and operating effectiveness of internal financial controls — widely understood as India's structural equivalent to SOX Section 404.
In recent years, growing cross-border investment into Indian companies by US-based institutional investors has meant that even businesses with no formal SOX obligation are asked, informally, to demonstrate SOX-equivalent control maturity as part of investor due diligence.
Step-by-Step SOX Compliance Process
- Scoping and Materiality Assessment — Identifying which business processes and locations are material enough to require formal controls testing.
- Process Documentation — Mapping key financial processes (revenue, procure-to-pay, payroll, financial close) and embedded controls.
- Risk and Control Matrix Development — Linking each control to the specific financial statement risk it addresses.
- Design Effectiveness Testing — Confirming each control, as designed, would actually prevent or detect a material misstatement.
- Operating Effectiveness Testing — Sampling actual transactions across the period to confirm controls operated as documented.
- Deficiency Evaluation — Classifying gaps as deficiencies, significant deficiencies, or material weaknesses.
- Remediation Support — Working with management to design and implement fixes, followed by re-testing.
- Certification Support — Preparing documentation supporting management's certification and Section 143(3)(i) reporting.
SOX Compliance Considerations Across Sectors
IT and Technology Services
Need particular attention to IT general controls — access management, change management, and system security.
Manufacturing Subsidiaries of US Parents
Typically need robust inventory and fixed asset controls tested, given materiality to consolidated group statements.
Financial Services and NBFCs
Need controls testing that also addresses loan provisioning and asset classification.
Companies with Shared Service Centres
Need controls testing that accounts for the centralised nature of processes across several legal entities.
Why Choose ND Savla & Associates for SOX Audit & Compliance?
- Practical experience with both Indian Section 143(3)(i) ICFR reporting and the more detailed testing standards US parent companies expect under group SOX programmes.
- Structured risk and control matrix methodology that scales from a single-entity ICFR engagement to a full group SOX testing programme.
- Coordinated with our Corporate Governance advisory, so controls work supports wider governance maturity, not just a compliance checkbox.
- Direct remediation support, not just deficiency reporting — we help design and test the fix, not only flag the gap.
- Relevant to companies preparing for an IPO Readiness Assessment, where strong internal controls increasingly matter to institutional investor confidence.
Note: Start controls documentation well before a US parent's group SOX certification deadline — first-time process mapping and testing consistently takes longer than expected, particularly where processes have never been formally documented before.
Important: Under the
Companies Act, 2013, statutory auditors are required to report on the adequacy and operating effectiveness of internal financial controls — unresolved deficiencies can result in a qualified audit opinion, with its own disclosure and reputational consequences.
Frequently Asked Questions
Is SOX compliance legally mandatory for Indian companies?
SOX itself is US law and applies directly only to US-listed companies and their subsidiaries; Indian companies more broadly are subject to Companies Act, 2013 Section 143(3)(i) ICFR reporting, India's structural equivalent.
What is the difference between ICFR under Indian law and SOX Section 404?
Both require testing of internal controls over financial reporting, but SOX Section 404 for larger US filers requires more extensive documentation and, in some cases, independent auditor attestation, whereas Indian ICFR reporting is assessed as part of the statutory auditor's regular audit opinion.
How long does a first-time SOX or ICFR testing engagement take?
Initial process documentation and risk and control matrix development typically take 6 to 10 weeks, with testing and remediation extending the full engagement to 3 to 4 months for a first-time implementation.
What happens if a material weakness is identified during testing?
A remediation plan is developed and implemented, followed by re-testing to confirm the control now operates effectively — material weaknesses typically need to be disclosed in the relevant certification until remediation is complete.
Do PE-backed companies without a listing need SOX-aligned controls?
Increasingly yes — many private equity investors expect portfolio companies to demonstrate SOX-equivalent control maturity as part of ongoing governance expectations, even without a formal statutory requirement to do so.