One of the fastest ways to make an internal control over financial reporting (ICFR) program expensive—and less useful—is to treat every account, location, system and control as equally important. A risk-based scope does the opposite. It starts with the consolidated financial statements, identifies where a material misstatement could arise, and focuses management’s evaluation on the controls that address those risks.
For financial controllers, scoping is not simply an annual SOX exercise. It is how finance decides which entities, processes, applications, reports and controls need disciplined ownership, testing and evidence. Done well, it creates a defensible program without turning the control inventory into an unmanageable catalogue.
Start with the rules that apply to your issuer
In the United States, SEC rules require covered issuers’ management to evaluate ICFR annually, with the applicable reporting and attestation requirements depending on the issuer’s status and circumstances. The SEC’s interpretive guidance, Release 33-8810, issued June 20, 2007 and effective June 27, 2007, describes a top-down, risk-based way for management to perform that evaluation. The SEC page records that the release was last reviewed or updated May 25, 2023. Read the SEC release and guidance.
In Canada, National Instrument 52-109 (NI 52-109) applies to reporting issuers other than investment funds. It requires certifying officers to make prescribed certifications. A non-venture issuer must establish and maintain disclosure controls and procedures (DC&P) and ICFR, and must use a control framework to design ICFR. If a non-venture issuer identifies a material weakness at period end, the instrument requires disclosure in its annual or interim MD&A. Venture issuers have different requirements under the instrument, including different certificate forms; do not automatically apply the non-venture issuer provisions to every Canadian issuer. The Alberta Securities Commission lists the consolidated instrument as amended September 19, 2025; the consolidation itself notes that it is for convenience and is not authoritative. See the ASC NI 52-109 instrument page and its September 19, 2025 consolidated text.
For a cross-border group, determine the requirements for each reporting issuer and each listing. NI 52-109 contains conditional exemptions for certain issuers complying with US requirements; those exemptions have conditions and do not mean every dual-listed company can simply ignore Canadian requirements.
10 practical steps for risk-based ICFR scoping
1. Begin with the consolidated financial statements
Set the scope from the reporting entity’s consolidated financial statements and disclosures, not from an inherited list of business units. Establish planning materiality and performance materiality using the methodology approved for the reporting process. Then consider qualitative factors: regulatory sensitivity, covenant implications, related-party activity, management estimates, unusual transactions, fraud exposure and the consequences of a misclassification or omission.
A small account can still be high risk. A relatively modest reserve may involve significant judgment; a low-volume related-party disclosure may carry heightened risk even when its balance is not large.
2. Identify significant accounts, disclosures and relevant assertions
For each material line item and disclosure, ask which assertions could be misstated: existence or occurrence, completeness, valuation or allocation, rights and obligations, and presentation and disclosure. The risk may differ within one account. For example, revenue may have completeness and occurrence risks in one sales channel, while another channel has complex cut-off or variable-consideration risks.
PCAOB AS 2201 describes the auditor’s top-down approach: move from financial-statement-level risks to entity-level controls, significant accounts and disclosures, relevant assertions, and then the controls that address those risks. Its risk factors include account size and composition, susceptibility to error or fraud, transaction volume and complexity, accounting complexity, related parties and changes from prior periods. This is an auditor standard, not a substitute for management’s own responsibilities; it is useful for understanding the audit lens. See PCAOB AS 2201.
3. Map the processes that can create the misstatement
For each relevant assertion, trace how a transaction is initiated, authorized, processed, recorded and reported. Identify the point at which an error or fraud could enter and the control that prevents or detects it. Do not document every operational step just because it appears in a process map. Concentrate on the steps that matter to financial reporting risk.
For example, for inventory valuation, trace the source cost build, standard-cost release, inventory movements, obsolescence review and valuation posting. If the risk is an inaccurate cost update, a control over the approved cost build and release may be more relevant than a generic monthly review of the entire inventory process.
4. Evaluate entity-level controls for their actual precision
Include controls over the control environment, management override, risk assessment, centralized processing, period-end reporting and monitoring. But do not assume that a high-level review automatically covers every account-level risk. A monthly executive review of consolidated results may identify unusual trends; it may not be precise enough to detect an incorrect customer rebate accrual or a missing lease liability.
Document what information the reviewer receives, the level of disaggregation, the thresholds and expectations used, the questions raised, and how exceptions are resolved. An entity-level control can reduce the need for additional controls only when it is designed and operates with enough precision to address the specific risk.
5. Select locations and business units based on risk, not revenue alone
For a group with US, Canadian and other international entities, assess each location’s contribution to consolidated accounts and disclosures alongside its risk profile. Consider transaction volume, process complexity, local accounting judgments, management changes, control history, unusual growth, system differences and exposure to fraud. Also assess shared-service centers separately where they process transactions for multiple entities.
A small entity may warrant attention if it handles a high-risk process or has a history of control failures. Conversely, a larger entity may rely on effective centralized controls for some processes. PCAOB AS 2201 Appendix B addresses risk-based scoping of locations and business units for the auditor; management should document its own rationale for the scope it adopts.
6. Include the systems, reports and interfaces that make controls work
Map the applications and technology supporting each in-scope financial process: ERP, consolidation, payroll, billing, treasury, tax, data warehouse, spreadsheets, interfaces and key reports. Identify the IT general controls that support reliance on automated controls and system-generated information, including user access, privileged access, program changes, system operations, interface monitoring and report logic.
If a control depends on a report, document how the report is generated, which parameters are used, who can change them, and how completeness and accuracy are validated. A well-designed review control can fail if the underlying report omits records or can be altered without detection.
7. Assess outsourced and shared-service dependencies
Where a service organization performs payroll, transaction processing, hosting or other activities that affect financial reporting, determine which risks and controls sit with the provider and which remain with the issuer. Review the relevant service auditor report, its period and scope, exceptions, complementary user-entity controls and any subservice-organization carve-outs. Confirm that your company actually performs the complementary controls and retains evidence.
Outsourcing a process does not transfer management’s responsibility for its financial reporting. Include the provider in the risk map, but distinguish provider controls from the controls your own personnel must operate.
8. Make fraud, estimates and period-end reporting explicit
Do not let a standard process inventory obscure the risks that often require the most judgment. Consider management override, unusual or manual journal entries, estimates, non-routine transactions, related parties, consolidation adjustments and disclosures. The PCAOB standard specifically highlights management override and the period-end financial reporting process, including journal entries, recurring and nonrecurring adjustments, accounting-policy decisions and preparation of financial statements.
For example, if a controller can post and approve a manual journal, a compensating independent review may be needed. If a reserve relies on a forecast, scope the controls over key assumptions, source data, model changes and approval—not just the final journal entry.
9. Document why each item is in or out of scope
Maintain a scoping matrix that connects each significant account or disclosure to relevant assertions, risks, processes, locations, systems, controls and testing approach. For every excluded account, location or process, record the rationale and supporting analysis. Avoid unexplained labels such as “immaterial,” “covered centrally” or “not in scope.”
Keep the documentation proportionate to risk. The SEC guidance expressly allows management to focus on controls that adequately address material-misstatement risks rather than identify every control in every process. It also recognizes that evidence-gathering can be more extensive in high-risk areas and more efficient in low-risk areas. The COSO Internal Control—Integrated Framework guidance is a useful foundation for designing and evaluating a coherent control system; COSO notes that the framework was refreshed in 2013.
10. Refresh the scope when the business changes
Scoping is not a once-a-year spreadsheet exercise. Reassess when the company acquires or disposes of a business, enters a new market, changes accounting policy, implements an ERP, outsources a process, changes a key system, restructures shared services or experiences a significant control deficiency. Update the risk-control matrix, ownership, locations and testing plan, and evaluate whether changes affect management’s conclusions or disclosure obligations.
A practical scoping matrix
| Scope dimension | Questions for the controller | Evidence to retain |
|---|---|---|
| Accounts and disclosures | Could a material error or omission arise? Which assertions are relevant? | Materiality analysis, risk assessment, assertion mapping |
| Processes and controls | Where could the misstatement occur, and which control addresses it? | Process narratives, walkthroughs, control descriptions |
| Entities and locations | What is the location’s risk to consolidated reporting? | Location assessment, shared-service coverage, inclusion rationale |
| Systems and data | Which applications, interfaces and reports support the control? | System inventory, ITGC mapping, report validation |
| Third parties | Which provider controls and user-entity controls are relevant? | Service auditor reports, gap analysis, user-control evidence |
| Change and monitoring | What changed, and does the scope still address current risks? | Change log, deficiency assessment, updated scope approval |
Controller’s final review checklist
- Confirm the applicable SEC, SOX and/or Canadian NI 52-109 requirements for each issuer.
- Start from consolidated statements, disclosures and approved materiality—not last year’s control list.
- Connect significant accounts and disclosures to relevant assertions and specific risks.
- Evaluate entity-level controls for precision before relying on them to cover lower-level risks.
- Use a documented, risk-based rationale for locations, shared services and business units.
- Include IT dependencies, system-generated reports, interfaces and service organizations.
- Address fraud, management override, estimates and period-end reporting explicitly.
- Retain evidence supporting inclusion, exclusion, testing and scope changes.
- Refresh the scope when significant business, process, system or regulatory changes occur.
Conclusion
A defensible ICFR scope is not the longest control inventory. It is a reasoned connection between the financial statements, the risks that could materially misstate them, and the controls that address those risks. Controllers should be able to explain why a process, location or system is included—or excluded—and show the evidence behind that decision. That discipline improves audit readiness, directs testing toward meaningful risks and helps finance leaders spend control effort where it matters most.
Informational only: securities-law and ICFR requirements depend on issuer status, listing, jurisdiction and available exemptions. Confirm current requirements with securities counsel and your external auditor before relying on this overview.
