The main difference between ICFR and SOX (Sarbanes-Oxley Act) is that ICFR (internal control over financial reporting) is required for SOX compliance by public companies to detect material errors and fraud in financial statements filed with the SEC.  SOX covers CEO & CFO (or chief accounting officer - CAO) annual report certifications (section 302) of internal control and the company’s financial statements adequacy, including disclosures, reporting the company’s internal control structure, and data security control policies. SOX regulatory requirements for internal control system policies and procedures (SOX 404) apply to companies and their auditors.