Testing SOX Compliance Testing Guide: IT Controls Testing for Sarbanes-Oxley SOX (Sarbanes-Oxley Act) Section 404 requires public companies to document and test internal controls over financial reporting.