Section 404 of the Sarbanes-Oxley Act of 2002 (SOX) requires publicly-traded companies to identify the major sources of business risks, document their internal control procedures, and hire external auditors to evaluate the validity and effectiveness of such procedures. Documentation is therefore crucial for analyzing the risks of errors, frauds, omissions, and similar mistakes in important business processes, as well as helping auditors evaluate the controls used to mitigate such risks—i.e., some of the major tasks required by SOX.