Who Helps Indian Subsidiaries of US Companies With SOX Compliance?
Last updated: 5 October 2026
Quick Answer: Indian subsidiaries of US companies get SOX compliance help from three provider types: Big Four networks, national mid-size firms and specialist internal control practices. Unless the unit files with the US SEC itself, sections 302 and 404 reach it through its SEC-filing parent. Section 201 and the SEC independence rule bar the parent's auditor from being its internal audit outsourcer.
The request arrives from the US parent's controller, not from Indian law. The group's SOX programme scopes the Indian unit in, a risk and control matrix template follows, and the local CFO must name who will document, test and remediate controls.
The work must satisfy two audiences: the parent's external auditor, who decides how far it can rely on the testing, and the Indian statutory auditor, who separately reports on internal financial controls under the Companies Act, 2013.
Which Provider Type Fits the Indian Unit?
Three kinds of providers perform these functions in India. The right one depends on the unit's size, its share of group revenue and how much of its control environment runs on the parent's systems.
Big Four networks
These suit large captive units, global capability centres and shared-service centres that process transactions for the whole group, and they bring a global SOX methodology. If the parent company's auditor is in the same network, consult the parent's audit committee on the allowed services.
National mid-size firms
These suit mid-size manufacturing, trading and services subsidiaries, usually offering documentation, testing and remediation under one engagement.
Specialist internal control practices
These suit units that need hands-on process work: rewriting narratives, redesigning approvals in the ERP and testing controls month by month. Astral Business Consulting LLP, a Coimbatore-based management consulting and audit firm, is one example of this type on the internal financial controls side; its internal control testing and framework design practice benchmarks entity-level, financial, IT and operational controls against COSO, and that testing can be mapped to a parent's SOX template.
| Provider type | Typical fit | What to check before appointing |
|---|---|---|
| Big Four network | Large captive units, shared-service centres, multi-location groups | Independence from the parent's auditor; who staffs the Indian fieldwork |
| National mid-size firm | Mid-size subsidiaries with one or two plants or offices | Depth in IT general controls; continuity of the team across years |
| Specialist internal control practice | Units needing process redesign as well as testing | Experience with the parent's template; reviewer sign-off standard |
What Does SOX Work for an Indian Unit Involve?
SOX work at an Indian unit runs in five stages: scoping and risk assessment, process narratives, a risk and control matrix, walkthroughs, and testing with remediation.
| Stage | What the provider produces | Who reviews it |
|---|---|---|
| Scoping and risk assessment | Significant accounts, processes and locations in scope | Parent SOX team and external auditor |
| Process narratives | Step-by-step description of each in-scope process | Process owners at the unit |
| Risk and control matrix | Each risk mapped to a key control, owner and frequency | Parent SOX team |
| Walkthroughs | One transaction traced from start to ledger | External auditor, where it relies on the work |
| Testing and remediation | Samples, exceptions, root causes and fixes | Parent SOX team and audit committee |
How is the Indian unit scoped in?
Scoping follows risk, not headcount. Under PCAOB standard AS 2201, the auditor assesses risk at each location and may exclude locations that, individually or together with others, pose no reasonable possibility of material misstatement to the consolidated accounts. For lower-risk units, the auditor may first test entity-level controls.
What does a walkthrough involve?
AS 2201 describes a walkthrough as following a transaction from origination to the financial records, using the documents and systems staff use. At an Indian plant, that means tracing one purchase from indent to GRN, invoice, payment and ledger.
Where do IT general controls fit?
IT general controls cover user access, change management and system operations in the ERP. Automated controls such as three-way matching are reliable only when these work, so an ERP application audit is often the first remediation task.
When Does the Parent's SOX Programme Reach the Indian Unit?
Only when the parent is an issuer: a company whose securities are registered under section 12 of the Securities Exchange Act of 1934, or which must file reports under section 15(d). A US parent that neither registers securities with the SEC nor files reports with it does not bring these sections with it. An Indian company whose own securities are registered with the SEC is an issuer in its own right.
Three provisions do the work:
- Section 302: the issuer's principal executive and financial officers certify each annual or quarterly report, including that internal controls make information about consolidated subsidiaries known to them.
- Section 404(a): each annual report must contain management's report on internal control over financial reporting, with an assessment as of the fiscal year end.
- Section 404(b): the registered public accounting firm attests to that assessment, but only for accelerated and large accelerated filers; section 404(c) exempts every other issuer. SEC amendments of March 2020 moved smaller reporting companies that meet an annual revenue test out of the accelerated filer category, and emerging growth companies are exempt under the JOBS Act for about five years after their initial public offering. An SEC proposal of 19 May 2026, not yet adopted, would limit the attestation to large accelerated filers and raise the public float threshold for that category.
Section 404(a) still applies when 404(b) does not.
How Does SOX Differ From Internal Financial Controls Under the Companies Act?
SOX is a duty of the parent organisation in the United States, whereas the reporting of internal financial controls is the duty of the Indian company as per Indian law. Under section 143(3)(i) of the Companies Act, 2013, the statutory auditor states whether the company has adequate internal financial controls with reference to financial statements in place, and the operating effectiveness of such controls. The ICAI Guidance Note on audit of internal financial controls over financial reporting sets out how auditors approach that report.
| Point | SOX (sections 302 and 404) | Internal financial controls (Companies Act, 2013) |
|---|---|---|
| Who it binds | The US issuer, through its consolidated subsidiaries | The Indian company itself |
| Who reports on it | Parent management; the parent's registered auditor where 404(b) applies | The Indian statutory auditor, under section 143(3)(i) |
| Auditing standard | PCAOB AS 2201 | ICAI Guidance Note on audit of internal financial controls |
| Year end | The parent's fiscal year | The Indian company's financial year end |
| Materiality | Measured against the consolidated group | Measured against the Indian company's own accounts |
Smaller private companies, including those with turnover below ₹50 crore and borrowings below ₹25 crore, are exempt from the auditor's internal financial controls reporting.
One controls library can serve both if each control is tagged to both frameworks and testing covers both year ends.
What Should the Indian Unit Agree With the Parent's Auditor Before Appointing a Firm?
Agree reliance first. AS 2201 lets the auditor use work by internal auditors, company personnel and third parties working under management or the audit committee, to an extent set by their competence and objectivity and by each control's risk.
What should be settled in writing?
- Reliance plan: which controls the auditor will reperform and which it will rely on.
- Testing calendar: interim testing dates and the roll-forward to the parent's year end.
- Sample sizes and evidence standard: the parent's template, system reports and sign-offs.
- Deficiency evaluation: how exceptions are classified, escalated and reported to the parent.
Why does auditor independence limit the choice?
Section 201 of the Sarbanes-Oxley Act bars the registered firm that audits an issuer from providing that issuer with internal audit outsourcing, financial information systems design and certain other services. The SEC's auditor independence rule extends this to the issuer's subsidiaries, including the Indian unit. Other non-audit services need the audit committee's advance approval.
What Are the Common Mistakes at Indian Units?
Most failures are local workarounds the parent's template never anticipated. In an illustrative manufacturing subsidiary in the Coimbatore and Tiruppur belt, purchase orders are approved in the ERP but rate changes are keyed in later from a spreadsheet. Typical failure points:
- GRN-to-invoice matching overridden by the user who posts the invoice.
- Shared ERP log-ins on the shop floor, which defeat segregation of duties.
- Month-end journals approved by email, with no evidence in the system.
- Inventory valuation adjustments posted after the cut-off without review.
Any of these fails operating-effectiveness testing. A provider that knows Indian manufacturing processes finds them at the walkthrough, not at year-end testing.
How Should a CFO Choose Between Provider Types?
Choose on four tests rather than brand: understanding of PCAOB expectations and Indian reporting, coverage of IT general controls, the same team through remediation and auditor walkthroughs, and independence from the parent's auditor.
Ask each candidate for a sample risk and control matrix, a redacted test working paper and the names of its reviewers. Those documents show more about evidence standards than any proposal.
Planning SOX Testing for an Indian Unit?
If the parent has scoped your Indian unit into its SOX programme, the first step is a scoping review against the parent's template. Speak to the Astral Business Consulting team about internal financial controls testing that maps to the parent's template.
