ICFR Management Assessment Template (SOX 404(a), Item 308)

ICFR Management Assessment: [Company name], fiscal year [YYYY]

Programme document for management's annual evaluation of internal control over financial reporting (ICFR): framework, materiality, scoping of significant accounts, assertions and locations, entity-level and IT general controls, service organisations, testing approach and timetable, roll-forward, deficiency summary, conclusion, draft management report and sub-certifications. Based on US public law: Sarbanes-Oxley Act of 2002 section 404(a) (15 U.S.C. 7262), Regulation S-K Item 308 (17 CFR 229.308) or Form 20-F Item 15 for foreign private issuers, Exchange Act Rules 13a-15 and 15d-15, and the SEC interpretive guidance for management in Release No. 33-8810 (34-55929, effective 2007-06-27), as of 2026-10. The control model is organised along the five components and 17 principles of the GAO Green Book (GAO-25-107721, 2025 revision). The COSO 2013 framework and PCAOB AS 2201 are cited by name and number only. Replace every [bracketed] value and every row marked Example. This is a document format, not legal, accounting or audit advice. Obtain the rules and standards for the normative text.

Document control

Approvals

Revision history

Contents

• 1. Regulatory basis and filer status
• 2. Framework and approach
• 3. Materiality and scoping
• 4. Entity-level controls
• 5. IT general controls scope
• 6. Service organisations
• 7. Testing approach and timetable
• 8. Roll-forward, changes and remediation window
• 9. Deficiency aggregation summary
• 10. Conclusion and draft management report
• 11. Sub-certifications and disclosure controls
• 12. Sign-offs and evidence retention
• 13. Glossary and references
• Standard and licence note

1. Regulatory basis and filer status

Section 404(a) of the Sarbanes-Oxley Act directs the SEC to require an internal control report in each annual report. The implementing rules ask management to state its responsibility for adequate ICFR, name the framework used, give its assessment of effectiveness as of fiscal year end and disclose any material weakness. Management may not call ICFR effective while a material weakness exists, and the report cannot carry a scope limitation. Section 404(b) adds an attestation by the registered public accounting firm for accelerated and large accelerated filers that are not emerging growth companies.

Filer status determination. Exchange Act Rule 12b-2 sets the status at fiscal year end using the worldwide market value of common equity held by non-affiliates on the last business day of the second fiscal quarter: USD 75 million or more but under USD 700 million for an accelerated filer, USD 700 million or more for a large accelerated filer, after at least twelve months of reporting and one annual report. An issuer that qualifies as a smaller reporting company under the revenue test is excluded from both categories; a foreign private issuer filing on Form 20-F cannot use smaller reporting company status, so for it the float test alone decides. Record the calculation and its sources.

Proposals to watch. In May 2026 the SEC published proposals that would revise filer status categories and could widen the exemption from the auditor attestation. They are proposals only as of 2026-10 and do not change this assessment. Check the status on sec.gov before each annual report and update this section if a final rule is adopted.

Corvid Commerce Group reports under IFRS as issued by the IASB, so its financial statements need no US GAAP reconciliation in Form 20-F. The ICFR objective is still the reliability of those IFRS statements; the rules define ICFR by reference to generally accepted accounting principles, which for this issuer means IFRS.

Because Corvid Commerce Group plc is also listed in London, it reports under the UK Corporate Governance Code, whose Provision 29 (for periods beginning on or after 2026-01-01) asks the board for a declaration on the effectiveness of material controls. That declaration covers more than financial reporting; reuse the ICFR evidence for its financial part and record it in the Material Controls Declaration (compliance/material-controls-declaration). Check the current FRC text for the requirement itself.

2. Framework and approach

Rule 13a-15(c) requires a suitable, recognised framework established by a body that followed due process with broad public comment. Most US listed companies name the COSO 2013 Internal Control Integrated Framework. US federal entities use the GAO Green Book. This template uses the Green Book's five components and 17 principles as its organising structure because the Green Book is a public US government work; the components and principle numbering are aligned with the COSO 2013 model, so the mapping is one to one. Management must still name, in its report, the framework it actually used and should obtain the framework it names, so that the evaluation can be checked against it. Do not copy framework text into working papers.

The approach follows the structure of Release 33-8810. First, management identifies financial reporting risks: the ways a material misstatement could arise in each significant account and disclosure. Second, it identifies the controls that adequately address those risks, including entity-level controls precise enough to do so on their own. Third, it evaluates evidence of operating effectiveness, scaling the nature, timing and extent of testing to the assessed ICFR risk, which combines the risk of the financial reporting element and the risk that the control fails. Fourth, it evaluates every deficiency for severity, alone and in combination, as of year end. Finally, it reports.

Reliance and coordination. The external auditor performs an integrated audit under PCAOB AS 2201 and decides for itself how far it uses management's testing. Agree early which controls internal audit or the internal control team tests, the objectivity of the testers and the evidence standard (sample sizes, documentation, re-performance) so the work can be used. Management's evaluation remains management's responsibility even when the auditor reaches the same conclusion.

3. Materiality and scoping

Materiality for ICFR is set by reference to the consolidated financial statements as a whole. Use the same benchmark as the financial statement audit where possible, so that management and the auditor scope the same accounts. The percentages below are an example of firm methodology, not a rule; neither the SEC rules nor Release 33-8810 set a percentage.

3.1 Significant accounts and disclosures

An account or disclosure is significant when there is a reasonable possibility that it contains a misstatement that, alone or with others, could be material. Start with every line above the scoping threshold, then add accounts below it that carry qualitative risk: fraud susceptibility, related parties, complex judgement or new systems. Assertions follow the categories used by the company's methodology; the example uses existence or occurrence (E/O), completeness (C), valuation or allocation (V), rights and obligations (R) and presentation and disclosure (P).

3.2 Locations and entities

Coverage check (Example): full-scope entities cover 67% + 14% = 81% of external revenue; with UK specific-account scope the revenue coverage is 100% (67% + 14% + 19%). Full-scope entities hold 51% + 16% = 67% of total assets, measured on the guarantor-basis gross assets of 112,000 (CC-DE 57,000, CC-US 18,000, parent and CC-UK 29,000, CC-VN 8,000; 51% + 16% + 26% + 7% = 100%); the UK and Vietnam are covered for their significant accounts only. Vietnam is in scope for capitalised development and payroll only; its revenue is intercompany service income eliminated on consolidation. Release 33-8810 lets management rely on entity-level controls and monitoring for low-risk locations; document why that is enough for any location left out of direct testing.

3.3 Fraud risk input

Use the annual fraud risk assessment (compliance/fraud-risk-assessment) as an input, mapped to Green Book Principle 8. At minimum, treat management override of controls and improper revenue recognition as fraud risks, and confirm that journal entry controls, manual adjustments and estimates reviews address them.

4. Entity-level controls

Entity-level controls vary in precision. Some, such as the tone set by the code of conduct, affect every other control indirectly but would not detect a specific misstatement. Others, such as a disciplined monthly results review with defined thresholds, can address a risk on their own if they operate at a level of precision that would detect a material misstatement. State which category each one falls into, since only the precise ones can reduce testing of process-level controls.

5. IT general controls scope

Automated controls and system-generated reports are only reliable if the general controls over the systems that run them operate throughout the period. Green Book Principle 11 covers these general control activities. Scope ITGCs from the RCM: every application named in an automated control, an IT-dependent manual control or an IPE row is in scope, together with its database and operating system layers where the company manages them.

6. Service organisations

Management keeps responsibility for controls over processes it outsources. When a service organisation performs a control the company needs, obtain evidence that it operates, usually a service auditor's report on controls with tests of operating effectiveness (a SOC 1 Type 2 report under SSAE 18, or an ISAE 3402 Type 2 report). The Green Book (paragraphs OV4.03 to OV4.05) describes the same idea: implement the complementary user entity controls the provider names and monitor the provider. Release 33-8810 notes that if no adequate evidence can be obtained and no compensating control exists, management must consider whether it can conclude that ICFR is effective, because the report may not carry a scope limitation.

Read each report for the auditor's opinion, the description of the system, the control objectives that matter to ICFR, any exceptions and the sub-service organisations carved out. Then record which of the company's own controls meet each CUEC (see compliance/risk-control-matrix section 7). A gap of more than three months between the report period end and fiscal year end usually needs extra procedures, such as a bridge letter, inquiry and stronger user-side review.

7. Testing approach and timetable

Design and implementation are confirmed by walkthroughs for each significant process every year, or when the process changes. Operating effectiveness testing is scaled to ICFR risk: higher-risk controls get more evidence, more direct testing and testing closer to year end; lower-risk controls may rely on ongoing monitoring and self-assessment with periodic validation. Record the reason when the evidence plan for a control is reduced.

8. Roll-forward, changes and remediation window

Because management concludes as of fiscal year end, results from interim testing must be updated. For each key control tested at interim, perform roll-forward procedures for the remaining period: at a minimum inquiry and observation for low-risk controls, and additional samples for higher-risk controls or those that changed. Controls that operate only at year end, such as the annual impairment review, the tax provision review and the disclosure committee review, are tested when they operate.

A deficiency remediated before year end can support an effective conclusion only if the new or fixed control has operated for long enough to give sufficient evidence. Set a firm remediation cut-off date based on control frequency, and record whether each remediated control reached it.

9. Deficiency aggregation summary

The SEC rules define a material weakness as a deficiency, or a combination of deficiencies, in ICFR such that there is a reasonable possibility that a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis. A significant deficiency is less severe but important enough to merit the attention of those overseeing financial reporting. Classify each deficiency by likelihood and magnitude, consider compensating controls, then aggregate by account, assertion and component. Release 33-8810 lists situations that indicate a material weakness may exist, such as fraud by senior management, a restatement to correct a material misstatement, or ineffective audit committee oversight; check each one explicitly. The detailed method is in compliance/control-deficiency-evaluation.

10. Conclusion and draft management report

Conclusion. Example: Based on the evaluation described in this document, management concludes that Corvid Commerce Group plc maintained effective internal control over financial reporting as of 2026-12-31. No material weakness was identified. Three control deficiencies were identified during the year. Two of them (DEF-2026-001 and DEF-2026-003) affected deferred revenue in the same month and together form one significant deficiency (AGG-01), which was reported to the audit committee and the auditor on 2026-10-14. All three deficiencies were remediated by 2026-10-15, the remediation retests passed by 2026-12-15 and roll-forward testing of the December operation was completed in January 2027. A significant deficiency does not prevent an effective conclusion; it is disclosed to the auditor and the audit committee through the certification process, not in the management report.

Draft management report (original illustrative wording, adapt with counsel).

Example: Management of Corvid Commerce Group plc is responsible for establishing and maintaining adequate internal control over financial reporting. Our internal control over financial reporting is a process designed to provide reasonable assurance about the reliability of financial reporting and the preparation of the consolidated financial statements in accordance with IFRS as issued by the IASB. Because of its inherent limitations, internal control may not prevent or detect all misstatements, and projections of any evaluation to future periods are subject to the risk that controls become inadequate or that compliance declines.

Management evaluated the effectiveness of our internal control over financial reporting as of 2026-12-31 based on the framework in [framework name and year]. Based on that evaluation, management concluded that our internal control over financial reporting was effective as of 2026-12-31.

[Auditor name] (Example: Ashgrove & Partners LLP), the independent registered public accounting firm that audited the consolidated financial statements included in this annual report, has issued an attestation report on our internal control over financial reporting, which appears in [location].

Record the Item 15(d) judgement on changes as well. Example: the remediation of AGG-01 and the new consolidation tool were evaluated under Rule 13a-15(d); neither materially affected ICFR, so no change is reported, and the evaluation is minuted by the disclosure committee.

If a material weakness exists, the report must say that ICFR is not effective and describe the weakness. Good practice is to describe its nature, the accounts affected, whether it caused a misstatement and the remediation plan and timeline, in plain language.

11. Sub-certifications and disclosure controls

Internal sub-certification is not required by rule but is common practice. Each process owner and entity head confirms in writing the matters within their control, and reports any exception. The disclosure committee reviews the results before the CEO and CFO sign. The evaluation of disclosure controls and procedures under Rule 13a-15(b) is separate from the ICFR assessment and has a wider scope, covering all information required in the annual report.

12. Sign-offs and evidence retention

Keep the evidence in one controlled repository with read-only copies after sign-off. Retain it for at least the period set by the company's records schedule (compliance/iso-15489-records-schedule) and any longer period required by law in each jurisdiction.

13. Glossary and references

References (obtain current versions):

• Sarbanes-Oxley Act of 2002, sections 302 and 404; 15 U.S.C. 7262 (US Code, 2024 edition, govinfo).
• 17 CFR 229.308 (Regulation S-K Item 308), eCFR.
• 17 CFR 240.13a-15, 240.15d-15, 240.13a-14 and 240.12b-2, eCFR.
• SEC Form 20-F, Item 15 and Instructions as to Exhibits 12 and 13.
• SEC Release Nos. 33-8810; 34-55929, Commission Guidance Regarding Management's Report on Internal Control Over Financial Reporting, effective 2007-06-27.
• GAO, Standards for Internal Control in the Federal Government (GAO-25-107721, May 2025), effective beginning fiscal year 2026.
• COSO Internal Control Integrated Framework (2013), name only; PCAOB AS 2201, number and title only; SSAE 18 and ISAE 3402, names only.
• Related templates: Risk and Control Matrix (compliance/risk-control-matrix), Control Testing Workpaper (compliance/control-testing-workpaper), Control Deficiency Evaluation (compliance/control-deficiency-evaluation), Fraud Risk Assessment (compliance/fraud-risk-assessment), Month-End Close Checklist (finance/month-end-close-checklist), Audit Committee Report (finance/audit-committee-report), SOC 2 Controls (compliance/soc2-controls).

Standard and licence note

Based on US public law and US government works: the Sarbanes-Oxley Act of 2002 (15 U.S.C. 7262), SEC rules in 17 CFR Parts 229 and 240, SEC Form 20-F, SEC Release No. 33-8810 and the GAO Green Book (GAO-25-107721), all summarised in original wording. The COSO 2013 framework, PCAOB AS 2201, SSAE 18 and ISAE 3402 are cited by name or number only; no text, principle statement, illustration or example from them is reproduced or paraphrased. This template is not affiliated with or endorsed by the SEC, GAO, COSO or the PCAOB. Corvid Commerce Group and all figures are fictional. This template is original text written for this collection. Check the current official versions of each rule, release and standard before use. Template licence: MIT.