The Fixed Asset Existence Assertion: How Physical Verification Proves PP&E Exists and Satisfies SOX 404

Three different things are routinely collapsed into one when controllers, internal auditors, and external auditors talk about fixed assets: the existence assertion, ASC 360, and SOX 404. They are not the same, and the distinction is exactly where a verified register earns its value. The existence assertion is an audit question. ASC 360 is an accounting standard. SOX 404 is a management ICFR obligation. This guide separates the three precisely, then shows how one piece of work — physical verification of the register — answers all three.

Existence assertion vs ASC 360 vs SOX 404 — three different things

The clearest way to keep these straight is to ask, for each one, who is responsible and what standard governs it. They operate in three different domains — audit, accounting, and internal control — even though they all touch the same PP&E balance.

The single sentence to remember: the existence assertion is applied to PP&E that is accounted for under ASC 360 (PP&E recognition, depreciation, and impairment) — ASC 360 does not define it. ASC 360 tells management how to carry the PP&E balance; the auditor then asks, independently, whether the assets behind that balance actually exist. The financial-statement assertions an auditor tests are existence/occurrence, completeness, rights & obligations, accuracy/valuation, cutoff, classification, and presentation; for PCAOB engagements, AS 1105 defines the “existence or occurrence” assertion as the proposition that assets exist at a given date.

How auditors test the PP&E existence assertion

Auditors test PP&E existence with directional procedures, and the direction matters because each direction answers a different assertion:

At each selected asset the auditor inspects the asset, matches the asset tag and serial number to the register, confirms location, and — where existence risk is elevated — reviews ownership documents. Under PCAOB AS 2110 the auditor first assesses the risk of material misstatement for the existence assertion; under AS 2301 the auditor designs substantive procedures responsive to that risk. For private-company audits, the equivalent AICPA standards are AU-C 315 (risk assessment) and AU-C 330 (responses). The supporting evidence is one of several types of audit evidence that verify existence, and physical inspection is among the most reliable because the auditor observes the asset directly.

Why a physically verified, evidence-backed register is also the SOX 404 control

Here is the part most teams miss. The same verified register does double duty. For the financial-statement audit it is the audit evidence of existence — the documented proof an auditor can re-perform. For SOX 404 it is the operating ICFR control over the existence of recorded PP&E.

Under SOX Section 404(a), management must assess and report on the effectiveness of internal control over financial reporting; under 404(b), the external auditor attests to that assessment, performing the integrated ICFR audit under PCAOB AS 2201. For PP&E, effective ICFR includes controls over the existence of recorded assets (alongside completeness and valuation). A recurring physical verification, with a retained evidence bundle and exception resolution, is precisely the control that gives management a defensible basis for its 404(a) assertion — and gives the auditor controls evidence to rely on, often reducing the extent of substantive testing.

This is also where ghost assets become a compliance issue rather than a housekeeping one. A ghost asset is a register entry for an asset that no longer physically exists but is still carried and depreciated. That is, by definition, a failure of the control over PP&E existence — and it overstates the balance. Ghost assets as a SOX existence-control failure can, depending on magnitude and compensating controls, escalate from a control deficiency to a significant deficiency or a material weakness in ICFR. The remedy is the same control that retires the existence risk: physically verify the register and resolve the exceptions. The discipline of building an evidence-backed fixed asset register is what turns a static spreadsheet into a control that operates.

For a complete walk-through of the control activities and ownership structure SOX expects around capital assets, see the fixed asset internal controls required by SOX.

How to make your fixed asset register audit- and SOX-ready

The following five steps turn a fixed asset register into defensible evidence of existence and an operating SOX 404 control. They mirror the verification work CPCON performs in the field.

1. Scope the material PP&E populations. Identify the asset classes and locations material to the PP&E balance and highest in existence risk — mobile, high-value, or recently disposed assets. Concentrate verification where a misstatement of existence would actually matter to the financial statements.
2. Physically verify register-to-floor and floor-to-register. Test existence by inspecting recorded assets on the floor; test completeness by tracing observed assets back to the register. The two directions answer two different assertions — run both.
3. Capture an evidence bundle for each asset. Record a tag or serial-number photo, condition, and location. This is the documented audit evidence of physical existence and the support an auditor can re-perform. The fixed asset verification checklist standardizes what to capture at each asset.
4. Reconcile to the general ledger and resolve exceptions. Reconcile the verified register to the PP&E sub-ledger and the GL. Investigate and dispose of exceptions — ghost assets (on the books, not on the floor) and unrecorded assets (on the floor, not on the books).
5. Document the recurring control and its cadence. Record the verification as a recurring ICFR control with a named owner, defined cadence, and evidence retention, so it demonstrates effective operation across the reporting period — not a one-time count.

Frequently Asked Questions