SOX internal-control framework (COSO-based)
SOX compliance programs assign control ownership through the control environment's Authority structure, test and document controls to build an auditable Evidence trail, and track deficiency remediation and retesting as a continuing Learning cycle.
U.S. Congress (Sarbanes-Oxley Act), built on the COSO Internal Control Integrated Framework, 2002
The origin of the framework, as the directory records it. The mark grades the origin, not this page.
Umbrex, SOX internal-control framework (COSO-based)
The directory entry this score was read from. Umbrex is a consultancy network; its summary is the reference, not a primary source.
Scored against the twelve cells, it loads three: Authority, Evidence, and Learning. The other nine it leaves to you. Of Composition, Evidence, and Mastery, the three cells that go blank first when an agent enters a workflow, it loads Evidence.
This is not a summary of the framework. Umbrex has one; the link under Sources goes there.
Which decisions may an agent make alone, and who is able to stop it?
What would you show an auditor, and can the system produce it without being asked?
How does tacit judgment become reusable, and who owns the loop that has to close?