The Sarbanes-Oxley Act (SOX) of 2002 imposes strict requirements on financial reporting and internal controls for U.S. public companies. For T & E processes, SOX compliance requires accurate recordkeeping to ensure financial transparency (Option I) and a reliable approval workflow to prevent fraud and ensure proper authorization (Option II). While report generation with visibility (Option III) is valuable for oversight, it is not explicitly mandated by SOX, which focuses on controls and documentation rather than specific reporting tools.

The web source from Tipalti states: “SOX compliance for T & E processes requires accurate recordkeeping to support financial reporting and a robust approval workflow to ensure proper authorization and prevent fraud.” This supports Options I and II. Option III, while beneficial, is not a direct SOX requirement, as SOX emphasizes controls over reporting mechanisms.

The IOFM APS Certification Program covers “Tax and Regulatory Compliance,” including SOX requirements for financial processes like T & E. The curriculum’s focus on “peer-tested best practices” aligns with the need for accurate records and reliable approvals to meet SOX standards.

An accountable plan, as defined by the Internal Revenue Service (IRS), is a reimbursement or allowance arrangement that meets specific requirements to ensure business expenses are properly documented and not treated as taxable income. One key requirement is that employees must adequately account for their expenses within a reasonable period. According to IRS guidelines, employees must submit expense reports or other documentation within 60 days after the expenses are incurred to meet the "reasonable period" standard.

The web source from the IRS states: “Under an accountable plan, employees must adequately account to the employer for their expenses within a reasonable period of time. The IRS considers 60 days after the expense was paid or incurred to be a reasonable period for accounting.” This directly supports Option B (60 days). The other options (120 days, 30 days, 90 days) do not align with the IRS’s specific timeframe for accounting under an accountable plan.

The IOFM APS Certification Program covers “Tax and Regulatory Compliance,” including IRS regulations related to expense reimbursements. The curriculum’s focus on “peer-tested best practices” and compliance with federal tax laws includes understanding the requirements of an accountable plan, such as the 60-day rule for expense accounting.

The Internal Controls topic in the APS Certification Program explains that detective controls are designed to identify errors, fraud, or control failures after they occur. They include activities like reviewing transactions for irregularities and assessing the effectiveness of preventive controls. Segregation of duties , however, is a preventive control, not a detective one, as it prevents fraud by dividing responsibilities.

Item I (Establish segregation of duties) : Segregation of duties prevents fraud by ensuring no single employee controls all aspects of a transaction (e.g., invoice approval and payment). This is a preventive control, not detective.

Item II (Look for errors and irregularities) : Detective controls, such as account reconciliation or audits, identify errors or fraudulent activities after they occur. This is a valid function.

Item III (Determine if preventive controls are effective) : Detective controls, like monitoring or control testing, assess whether preventive controls (e.g., vendor validation) are working. This is a valid function.

Option A (I, II, and III) : Incorrect, as Item I is a preventive control.

Option B (I and III only) : Incorrect, as Item I is not a detective control function.

Option C (II and III only) : Correct, as Items II and III describe detective control functions.

Option D (I and II only) : Incorrect, as Item I is not a detective control function.

Reference to IOFM APS Documents : The APS e-textbook under Internal Controls states, “Detective controls, such as audits and reconciliations, look for errors and irregularities and evaluate the effectiveness of preventive controls.” It clarifies that “segregation of duties is a preventive control to avoid conflicts of interest.” The training video discusses detective controls as tools for “post-transaction review and control assessment,” excluding segregation of duties.