sox法案基本上于06年塵埃落定，如果不是在美國上市公司工作，可能缺乏practice的經(jīng)驗(yàn)，我在課本上畫了個(gè)表，總結(jié)如下：來源：

1。關(guān)于section 404:  ceo  and cfo need to certify the control related to financial reporting are effective and in place. senior management should take personal responsibility on the financial integrity.

這句話就是講了sox是要干什么的。

2。auditor的責(zé)任： assess the control and integrity of financial statement.

3.auditor具體要做什么，（圍繞以下四點(diǎn)吹水即可）
事實(shí)上偶們公司的sox 項(xiàng)目也是這樣做的：
detailed documentation for financial related process.
full verification on compliance is required annually.
documentation should be reviewed and updated if the system or process are changed.
identify the control point, test, oberservation and control activity.

4. sox對于一個(gè)企業(yè)的成本：  skilled people + plenty of time (internal control function and management team)+ cost

以上四點(diǎn)對于2。6 和3。6 里面的于內(nèi)控有關(guān)的題目亦有幫助。