SOX and Internal Controls in Practice: Make Controls Real, Not Paper
Signature Course No. 420 — A Signature AI Socratic Coaching Course.
No experience needed — your coach starts where you are.
A New Kind of Learning
Socratic coaching, delivered by an agentic AI coach.
Not a course you watch. An AI coach you work with.
The Lighthouse Coach begins by discovering how you think about the subject, teaches what is missing, and gives you realistic practice before asking you to prove that you can use it. You may test out of concepts you already understand, while capstones turn the learning into a practical plan, decision, conversation, or other real-world result.
The curriculum is deliberately authored; the AI delivers it through coaching. It is not an AI randomly generating lessons.
A coach that teaches by asking — not by lecturing
The Lighthouse Coach is an AI Socratic coach built on Cognosco Learning's SOX and Internal Controls in Practice: Make Controls Real, Not Paper course, in the Risk, Safety & Compliance category. It does not play videos at you. It holds a conversation: it asks you a question, listens to your answer, names the misconception it hears, affirms what you got right, and asks the next question — the way a great coach works in the room.
A control that exists only in a binder is not a control. It is a description of a control — and the difference is discovered, expensively, in public, when a tester asks for evidence that the review happened, when a terminated employee's access still works, or when an error reaches the financial statements that a well-designed review should have caught. This course teaches you to build an ICFR system that operates on ordinary Tuesdays, survives staff turnover and system changes, produces evidence as a byproduct of doing the work, and supports a conclusion management can sign without crossing its fingers.
It starts with the regime in one picture. Section 302, the certifying officers' quarterly certification; Section 404(a), management's own annual assessment; Section 404(b), the external auditor's attestation where it applies — three duties, three owners, never confused. Underneath them, the COSO map: five components, seventeen principles, all present and functioning or the system is not effective. And one distinction held from the first concept: disclosure controls are the broader set; ICFR is the financial-reporting subset inside it.
It works in two movements. First, Module 1 — Foundations: From Law to a Control System That Can Be Tested — work through Concepts 1–9, finishing with Scope and Design the Changed Business; then, Module 2 — Operation, Judgment, and Closure: Test It, Classify It, Fix It — work through Concepts 10–18, finishing with Evaluate, Classify, and Remediate at Year-End.
Both capstones produce real artifacts — a Scoping and Design Pack for a business that changed three ways in one year: a manually billed subscription offering, a small components maker acquired mid-year, and a plant controller's retirement, scoped top-down against $3.2 million planning materiality with its risks stated as WCGWs and its controls designed to answer them; and a Year-End Evaluation and Remediation Pack that assembles a year of testing results, classifies every open item under one consistent logic, and states the only assessment conclusion the facts support.
The honesty standard is part of the course. This course is information, not professional advice: it teaches the durable structure of the regime and flags every revision-sensitive point — who must obtain an auditor attestation, a threshold, a filing detail — to verify against the current text of SEC rules, PCAOB standards, and the COSO framework before you rely on it. Working from a remembered rule instead of a current one is itself a control failure. And the classification discipline never bends: likelihood, magnitude, aggregation, compensation — the same logic, applied the same way, in every concept and both capstones.
The course is self-paced and always on — roughly 30 minutes per concept, about 9 hours in full, taken in as many sittings as you like. You can type your answers, or talk out loud: the Voice Coach speaks its questions and listens to your spoken replies. Learners who already know the material can test out concept by concept.
SOX and Internal Controls in Practice: Make Controls Real, Not Paper is part of The Lighthouse Signature Series — the online counterpart to the one-day, in-person learning Cognosco Learning has delivered since 2002.
Course Facts
One full concept, coached end to end — free: verify your email and we’ll send you a link to start.
Already enrolled? Enter the course →
Diagnose → Learn & Practice → Prove → Capstone
Every learner moves through the same discipline a Cognosco instructor would insist on in the room.
Diagnose
The Coach starts where the course starts: with who owes what. In your organization, who actually signs what at quarter-end and at year-end — and could you say, for each signature, which section of the Act stands behind it? If your external auditor withdrew tomorrow, which SOX duties would remain entirely yours, undiminished? And the last disclosure problem you saw — late information, a wrong non-financial figure, a missed filing item — was that a disclosure-controls failure, an ICFR failure, or both, and what makes you say so? Every concept opens with three questions that locate where you actually stand, and your answers shape how deeply the Coach works the concept with you. Everyone begins with Module 1 — no skipping the foundations you only think you have.
Learn & Practice
Work each concept in conversation with the Coach — spoken or written — then practice it against realistic situations until it holds up.
Prove
Every concept ends in proof: answer the check cold and demonstrate the skill. Know it already? Test out and take credit immediately.
Capstone
Finish with two capstones — Scope and Design the Changed Business for Module 1 and Evaluate, Classify, and Remediate at Year-End for Module 2 — that pull the whole course together, and earn the certificate.
What You'll Learn
Nobody signs an opinion about a binder. They sign about a system that operated. So this course builds the system in the order reality will test it: scope from the statements, state the risk before designing anything, and reach every classification by one logic — likelihood, magnitude, aggregation, compensation — applied the same way every time.
Module 1 builds the system on paper the right way. The regime and who owes each duty; the COSO map of five components and seventeen principles; scoping and materiality from the financial statements; what could go wrong, stated at statement and assertion level; the control environment and the entity-level controls above the controls; process-level design, where precision is the control; segregation of duties and access; and documentation a stranger could walk through.
Module 2 operates the system under scrutiny. IT general controls inside ICFR; the reports, spreadsheets, and IPE every review leans on; management's own testing, with honest sampling and honest deviations; working with the external auditor as a separate evaluator, neither adversary nor substitute; the deficiency judgment across two concepts, from the logic to its hardest boundary cases; remediation that actually closes; the assessment and the certifications; and the program run all year, at the speed of change.
And it holds its seat throughout. Every case is worked from the seat of the people who own the regime day to day — controllers, SOX program managers, and process owners — on one running company, Ostwick Industries, a fictional maker of industrial fasteners whose statements, close, plants, and control failures you will meet across both modules, so that later judgments rest on facts you already hold.
What you will learn
- State what Sections 302, 404(a), and 404(b) each require, who owes each duty, and how disclosure controls differ from ICFR
- Organize a control system on the COSO map — five components, seventeen principles — and spot which component a failure belongs to
- Scope ICFR from the financial statements: material accounts and disclosures, relevant assertions, and significant locations
- Assess risk at statement and assertion level — name what could go wrong before designing anything
- Design entity-level and process-level controls with stated precision, in preventive and detective, manual and automated forms
- Separate duties and govern access so no one person can run a transaction end to end and hide it
- Document controls — narratives, flowcharts, and risk-and-control matrices — and prove design through a walkthrough
- Run IT general controls and validate the reports and spreadsheets other controls rely on
- Test design and operating effectiveness, sample honestly, and evaluate deviations without wishful thinking
- Classify deficiencies consistently — deficiency, significant deficiency, material weakness — including aggregation and compensating controls
- Remediate to closure: root cause, redesign, enough operating time, and a retest that could fail
- Support management's assessment and the 302 certifications, and run the program on a year-round calendar that responds to change
Everything in the course
- All 18 concepts of SOX and Internal Controls in Practice: Make Controls Real, Not Paper, in 2 modules
- A starting-point check first — the Coach finds where you actually stand before teaching
- Learn, Practice, Prove for every concept — no passive video watching
- A test-out on every concept: prove you know it and move on
- The Voice Coach: talk with the Coach out loud — it speaks, listens, and replies
- A personal Learner Record of your work across the course
- Two capstone exercises: Scope and Design the Changed Business and Evaluate, Classify, and Remediate at Year-End
- A printable session summary whenever you pause
- The Lighthouse Coach completion certificate (Signature Series)
- Your progress is saved as you go — stop anytime, resume where you left off
Built for the people who own the regime day to day
Controllers and assistant controllers — who own the close, the accounts, and ultimately the conclusion about whether ICFR is effective; and SOX program managers — who run the calendar, the documentation, the testing, and the remediation log, and who must tell leadership the truth about where the program stands.
Process owners — in revenue, purchasing, payroll, inventory, treasury, tax, and IT — who own individual controls and need to understand what makes their control well designed, what evidence it must leave, and what its failure would mean.
Finance leaders preparing for a first audit of ICFR, a system change, an acquisition, or a remediation year — who need the whole regime in one coherent picture before they are inside it. This course assumes working fluency in financial statements and the accounting cycle. It assumes no prior SOX program experience; the regime is built here from its structure up.
Prefer to learn live and in person? The same material anchors Cognosco's one-day programs — browse the in-person catalog.
Start with The Regime in One Picture
$195 — introductory price. One payment. No subscription, no password to manage.
Here is exactly what happens when you enroll:
- Pay securely with Stripe — you are taken straight into the course
- Create your learner profile and begin the Module 1 starting-point check
- Save the access key you are given — it restores your enrollment on any device
- Learn at your pace; your progress is stored in your browser on your device
For the full voice experience, use Chrome and allow the microphone when asked. Typing your answers works everywhere, all the time. Questions before you enroll? Email hello@cognoscolearning.com.
Before you enroll
What is a Socratic coaching session?
A conversation, not a video. Your coach asks a question; you answer — out loud by voice, or by typing — and the coach responds to what you said: naming the misconception it hears, affirming what you got right, and asking the next question. You advance only when you have mastered each concept, so a finished course means the learning held.
How long does it take — and how long do I have?
About 30 minutes per concept. Learn in sittings of any length; your progress is saved as you go. You have a full year from purchase to finish, and you can revisit and retake within that year.
What does the certificate verify?
That you completed every concept and both capstones of this course. Anyone can confirm a Cognosco certificate online — enter its certificate ID on our verification page.
What if it isn't for me — what are the refunds?
If you have not started, cancel for a full refund within seven days of purchase. Once you have started, there is no cash refund — stop before finishing and we credit the full amount you paid toward any other course in the library (credit valid one year from your original purchase). Once you complete the course, no refund or credit applies.
More Signature Courses are coming
SOX and Internal Controls in Practice: Make Controls Real, Not Paper is Signature Course No. 420. Leave your email and we'll send you news of future Signature Courses and Lighthouse updates as they are announced — nothing else.