Using AI to check whether the J-SOX three-piece set meets financial reporting internal control requirements

A corporate planning team at a listed company was working on J-SOX design assessment for internal control reporting under the Financial Instruments and Exchange Act. It happens every year, but confirming completeness and consistency across the three-piece set still burdens the team.

The process narrative, flowchart, and RCM are often created independently, so risk IDs can drift between documents and key-control (KC) flags can be missed. In practice, reviewers manually compare them while reading dozens of pages of implementation standards for internal-control assessment and audit.

Design assessment is not the only issue. Each management assessment and auditor review brings questions, and teams must repeatedly find and explain the source evaluation-standard text. They had long wanted a way to show later why each control was acceptable and which evaluation standard supported it.

First, we did not configure anything difficult."Check whether the sales-process three-piece set satisfies design and operating-effectiveness assessment requirements for ICFR."We entered that in everyday language. After dragging and dropping the process narrative, flowchart, and RCM files, AI automatically assembled the workflow and review viewpoints.

No programming knowledge or complex rule setup is required. You can inspect and edit the generated workflow, then reuse the same viewpoints for future design assessments. When the process changes, replace the target documents and run the same workflow.

After saving and running the workflow, AI compares the three-piece set against implementation-standard and assessment-guideline requirements one viewpoint at a time. Results are consolidated on this screen. The key point is thatevery decision always includes which evaluation standard and clause support it. Humans can verify the source text instead of taking AI on trust.

The 4 viewpoints AI marked as conformant can be cleared quickly because evidence is attached. Humans spend judgment ononly the 4 items that need attention: 2 needs-review and 2 non-compliant items. The reviewer returned the two non-compliant items to the document owner, reran AI on the corrected and resubmitted RCM, and finally approved all viewpoints.

All operations and decisions are recorded in a tamper-resistant audit log. You can fully trace who decided what, when, and based on which evidence, so it can be used directly for external auditor explanations. There is no need to recollect evidence when preparing management assessment reports; it can be presented immediately as an audit trail.

A consistency check that had taken 2-3 days per process manually was completed in just a few hours. The full design-assessment period across all processes was reduced from two weeks to two days. Most importantly, the team found the missing KC identification and risk-ID mismatch before auditors did. It was the first design-assessment period completed with zero deficiency findings from auditor review.

This example used a J-SOX design-assessment inspection of the three-piece set, but INDX Compliance works the same way across use cases. Provide benchmark documents, such as implementation standards, assessment guidelines, and higher-level policies, together with the documents you want checked, such as the process narrative, flowchart, and RCM, then compare them with evidence. ISO internal-audit pre-checks, internal policy conformity checks, contract reviews, and any other work that involves matching against rules can use the same workflow. By reusing a workflow from design assessment through operating assessment and ongoing monitoring across fiscal years, J-SOX work can run as a system.