[Verse 1]
When the books must tell the truth and nothing but the truth
ICFR steps in to guard what matters most
Design the controls that catch what could go wrong
Implementation follows what the framework chose
Document each process, map the flow with care
Entity level down to transaction tests
[Chorus]
Design, Implement, Test and then Assess
Document, Evidence, nothing left to guess
Operating effectiveness through the year
ICFR makes the financial picture clear
Design, Implement, Test and then Assess
Controls that work and pass the audit test
[Verse 2]
Entity level sets the tone from up above
Management philosophy flows down the line
Board oversight and audit committees watch
Risk assessment helps the framework shine
Control activities catch the errors made
Information systems process what we find
[Chorus]
Design, Implement, Test and then Assess
Document, Evidence, nothing left to guess
Operating effectiveness through the year
ICFR makes the financial picture clear
Design, Implement, Test and then Assess
Controls that work and pass the audit test
[Bridge]
Walk through testing shows the process works
Re performance proves it happened right
Inspection of the documents and records
Inquiry confirms what's in our sight
Sample sizes must be large enough
Deficiencies get classified by type
[Verse 3]
Material weakness stops the CEO
From certifying that the controls are sound
Significant deficiency needs attention fast
Before the annual audit comes around
Management testing happens all year long
While auditors test what management has found
[Chorus]
Design, Implement, Test and then Assess
Document, Evidence, nothing left to guess
Operating effectiveness through the year
ICFR makes the financial picture clear
Design, Implement, Test and then Assess
Controls that work and pass the audit test
[Outro]
SOX four oh four requires the dance
Public companies cannot take the chance
ICFR protects investors everywhere
Financial reporting handled with such care