Internal Controls and SOX Scoping for a Small Japan Subsidiary

Internal controls for a small Japan subsidiary are the approvals, access rights, custody rules, and reviews that keep the entity's books, payments, and filings reliable when it has no local finance team. For a group that reports under the Sarbanes-Oxley Act (SOX), the question is how far the Section 404 assessment of internal control over financial reporting reaches into a Japan entity of 5 to 50 people, and which controls headquarters needs even when the entity falls outside detailed testing. Two features make Japan different from most subsidiaries: the registered company seal can authorise contracts and bank changes on its own, and much of the routine work sits with an outsourced provider and licensed professionals rather than employees. This guide covers how SOX and Japan's regime apply, the key control points, outsourced processes, and electronic record rules.

Key Takeaways

• SOX applies at group level. Section 404 requires the issuer's management to assess internal control over financial reporting for the consolidated group, so a Japan subsidiary is in the population even when it is scoped out of detailed testing.
• J-SOX follows the listing, not the subsidiary. Japan's internal control report system under the Financial Instruments and Exchange Act obliges listed companies; a subsidiary of a foreign parent is not caught by it unless a Japan-listed company consolidates it.
• The company seal is a control point. The registered seal (実印, jitsuin) and the bank seal can bind the company, so their custody and use need the same discipline as a signature authority matrix.
• Outsourcing moves the work, not the responsibility. Japan's own internal control standard states that the company remains responsible for outsourced processes and must assess the controls the service organization operates.
• Electronic records are part of the control environment. Invoices, receipts, and contracts exchanged electronically must be kept as electronic data meeting the National Tax Agency's storage requirements.

Does SOX Section 404 Reach a Small Japan Subsidiary?

SOX 404 covers the issuer's consolidated reporting, so the Japan entity sits inside the assessment even if the group tests it lightly.

The obligation sits with the issuer. The SEC's 2003 final rule implementing Section 404 requires a management report on internal control over financial reporting in each annual report filed under Sections 13(a) or 15(d) of the Exchange Act, and states that Section 404 "makes no distinction between domestic and foreign issuers". Foreign private issuers were required to comply from their first fiscal year ending on or after 15 April 2005. A US-listed or foreign private issuer group therefore assesses controls over its consolidated financial statements, and every subsidiary, including a small Japan KK or GK, contributes to those statements.

What the subsidiary's place in the assessment looks like is a scoping decision made by group management with the group auditor. Small components are commonly covered by entity-level controls, analytical review, and a limited set of transaction controls rather than full process testing. That decision belongs to the group, not to the Japan entity or its provider, and it can change as the subsidiary grows, acquires customers in new lines of business, or starts handling cash for other group entities. Being scoped out of detailed testing does not remove the risk; it means the group relies on a few controls to catch problems a fuller assessment would test directly. Where the Japan entity sits in the wider finance model is set out in Japan subsidiary finance for the group CFO.

Does J-SOX Apply to a Foreign-Owned Japan Subsidiary?

Japan's internal control report system applies to listed companies, so it reaches a foreign-owned subsidiary only via a Japan-listed parent.

Japan introduced its own internal control report system, often called J-SOX, under the Financial Instruments and Exchange Act enacted in June 2006. According to the Financial Services Agency's 2007 standard on management assessment and audit of internal control, "the management of listed companies shall implement assessments of internal controls over financial reporting", audited by certified public accountants, from fiscal years starting on or after 1 April 2008. The Business Accounting Council revised the standard in 2023, adding items to the internal control report and the auditor's report. A wholly owned subsidiary of a US or European parent is not itself listed, so the system does not apply to it directly.

The exception runs the other way. Where a Japan-listed company consolidates a foreign subsidiary, the same FSA standard says foreign subsidiaries should be considered in the scope of management's assessment, and allows reliance on an appropriate internal control reporting regime in the subsidiary's own country. For the typical reader of this guide, a Japan entity owned by a foreign group, SOX or the parent's home-country regime is the framework that matters, with Japanese law shaping the specific controls.

The Control Points That Matter in a Small Japan Entity

A small Japan entity relies on eight control points: payments, bank rights, seal custody, duties, system access, e-filing, review, and records.

The table below lists the controls headquarters should design into a Japan subsidiary from the start, the evidence that shows each one operated, and who owns it. The aim is a set the group auditor can understand and test without visiting Tokyo, built around the places where a small foreign-owned entity is exposed: cash, the company's legal authority, and access to systems and government portals.

Risk area	Control	Evidence	Owner
Payments	Provider prepares payment batches; a named approver at headquarters releases them	Bank approval log with approver identity	Headquarters
Bank administrator rights	Administrator rights held by the company, not the provider; changes require two people	Bank user list reviewed quarterly	Headquarters
Registered seal and bank seal	Custody by a named person; each use approved in advance and logged	Seal use log with document, date, approver	Representative director
Segregation of duties	Where one provider employee records and pays, headquarters reviews the bank reconciliation monthly	Signed or system-dated reconciliation review	Headquarters
Accounting system access	Headquarters holds administrator access and removes users when people change	User access list reviewed quarterly	Headquarters
E-filing credentials	e-Tax, eLTAX, and gBizID accounts registered to the company, with access granted to the provider or licensed professional	Credential register showing account owner	Headquarters
Journal entries and close	Manual journals above an agreed threshold approved; variances explained in the monthly package	Journal approval trail and variance commentary	Provider, reviewed by headquarters
Electronic transaction records	Invoices and receipts received electronically stored as electronic data meeting the storage requirements	Repository location and search index	Provider

The seal row is the one most often missing from group control frameworks written elsewhere. A registered seal impression, together with a seal certificate, is how a Japanese company signs contracts, registration applications, and bank changes, and whoever holds it can act for the company. The governance side, including how a group approval matrix maps onto Japanese company law, is covered in delegation of authority in a Japan subsidiary. The e-filing portals that need a credential owner are described in the guide to gBizID.

Controlling Outsourced Processes in a Japan Subsidiary

A Japan subsidiary stays responsible for processes it outsources, so headquarters needs evidence the provider's controls are designed and operate.

Japan's own standard makes the principle explicit. The FSA's 2007 standard states that "the company is responsible for the outsourced processes, and should include internal control of them in the scope of assessment", and that where an outsourced process is significant, management should assess the effectiveness of the controls operated by the service organization. SOX practice reaches the same place by a different route: the group auditor asks how the group knows the provider's controls work.

The standard form of evidence is a SOC 1 report, which the AICPA describes as a report on "controls at a service organization that are likely to be relevant to user entities' internal control over financial reporting". Large providers can often supply one. Smaller providers usually cannot, and the alternatives are a documented walkthrough of the provider's process by internal audit or the group auditor, or sample testing of the provider's output against source documents, which the FSA standard also lists as a valid method.

Licensed professionals add a layer. Corporate tax returns are prepared and signed by a zeirishi (税理士, certified tax accountant), and paid social and labour insurance filings are made by a sharoushi (社会保険労務士, labour and social security attorney). The control question for headquarters is the same for each: who is the named professional, what does the provider check before the filing goes out, and what does headquarters see afterwards. A provider that coordinates these professionals should be able to show the hand-offs. The selection questions that surface this are in how to choose a back-office provider for a Japan subsidiary.

Electronic Records and the Japan Document Trail

Japan requires invoices, receipts, and contracts exchanged electronically to be kept as electronic data, which makes storage part of the control set.

The National Tax Agency's guidance on electronic transactions states that when businesses send or receive electronic data for invoices, receipts, contracts, or quotations, that data must be stored in a form that meets the prescribed requirements. Printing the data and keeping paper was accepted only for electronic transactions up to 31 December 2023; from 2024 the data itself must be stored under the requirements. For a subsidiary that receives most supplier invoices by email or through portals, this turns the document repository into a control: where the files are kept, how they can be searched, and how changes and deletions are prevented.

The NTA publishes sample internal rules for preventing correction and deletion of electronic transaction data, which a provider can adopt as the entity's written procedure. Headquarters should know where the repository sits, who can delete from it, and whether it stays with the company if the provider changes. The same records support the group auditor's sample testing and any tax office examination.

The case for treating this as a control rather than an administrative detail is data trust. According to the Journal of Accountancy's 2024 report on a BlackLine survey of more than 1,300 finance professionals in seven countries, 37% of CFOs do not completely trust the accuracy of their organization's financial data. A subsidiary whose source documents can be retrieved and traced to the ledger is one the group can rely on with less testing.

Frequently Asked Questions

Is a small Japan subsidiary in scope for SOX 404?

The Japan subsidiary is part of the consolidated group that SOX 404 covers, so it is always in the population. Whether it is tested in detail is a scoping decision made by group management with the group auditor. Small components are commonly covered through entity-level controls and analytical review, with a few key transaction controls such as payment release and bank reconciliation review.

Does J-SOX apply to a Japan subsidiary of a US company?

Not directly. Japan's internal control report system under the Financial Instruments and Exchange Act applies to listed companies. A wholly owned subsidiary of a US or European parent is not listed in Japan, so its controls are assessed under SOX or the parent's home-country regime rather than J-SOX.

What if the back-office provider cannot supply a SOC 1 report?

Many smaller providers cannot. The usual alternatives are a documented walkthrough of the provider's process by internal audit or the group auditor, and sample testing of the provider's output against source documents. Japan's internal control standard lists sample validation as an acceptable way to assess controls over an outsourced process.

Working with AQ Partners. Our Tokyo team provides back office operations for foreign companies operating in Japan, including monthly bookkeeping, bank payment support, entity seal storage and administration, and corporate document storage. Book a consultation to discuss your Japan controls setup.