Internal Control

The long view, in 8-K filings

An 8-K is filed within four business days of an event, so this counts filings made because something happened. Every month since 2008. The last point is the current month and is still filling, so it always looks lower than it will be.

Who disclosed it

From SEC full-text search over 8-K filings. Every row links to the filing itself.

The full search on EDGAR

Who is hiring for it

A sample of the open roles naming this phrase. An employer paying a salary against something is the least ambiguous demand signal there is, and every row links to the posting so the claim can be checked rather than believed. The total above is the whole US market; these are the ones we hold the posting for.

How it actually arrives

An 8-K's meaning is in its item number, not its text. These are the items the filings containing this phrase were filed under. The first group is something that happened to the company. The second is the phrase turning up in the ordinary course of reporting, most often in an earnings release, which is a very different thing and is usually the larger number.

This is why a headline count on its own overstates the case. Where the routine number dominates, the phrase is being tracked as language rather than as events.

Which industries file it

Companies grouped by the industry classification on their own filing. A count, not a survey.

What it obligates

Our corpus holds 94 controls across 33 frameworks whose text speaks to this. Not a judgement: these controls say so, and each is one lookup from its source document. Ordered by how much each framework has to say about it, so the one that will cost you the most work is first. Every name opens that framework in the corpus.

What an auditor will ask you to produce

The artefacts named on those controls, most frequently cited first.

• Board charter
• Control matrix
• Policies mapped to COSO 17 principles
• Risk assessment workpapers
• Internal and external communication evidence
• Fraud risk assessment results
• Code of conduct
• Org structure document

How it usually fails

Recorded when each control was verified against its source. This is where programmes that think they are covered turn out not to be.

• Principles not mapped
• Fraud assessment skipped
• Communication ad hoc
• Changes lack analysis
• Code not communicated
• Board not independent

What this obligates

The instruments in our corpus that govern this disclosure, and how many controls sit behind each. This is not a filing count. It is what applies once a company has written the phrase down.

3 frameworks, 249 controls between them.

What closing it also moves

The same controls appear in other frameworks through mappings held in our corpus. Work done here is already progress there. This is the part that is not in EDGAR and not in any public dataset: it comes from mappings built and verified by hand, control by control.

Counted as controls reached through cross-framework mappings. It measures overlap of work, not compliance with the named framework.

Today's edition · How programmes fail · The obligation index