Access to programs and data
IT general controls that keep access to financially significant applications, databases and infrastructure limited to authorized people with appropriate duties.
SOX IT general controls
IT general controls that public companies maintain and auditors test under Sarbanes-Oxley Section 404. There is no official ITGC catalog; the pillar uses the four areas named in SEC guidance (access, program changes, program development, computer operations) and covers the controls auditors commonly test.
Program changes
IT general controls that make sure changes to financially significant applications, configurations and infrastructure are authorized, tested and approved before reaching production.
Program development
IT general controls over acquiring, building and implementing new financially significant systems, including testing, data conversion and go-live approval.
Computer operations
IT general controls that keep financially significant processing running completely and accurately: job scheduling, backups and recovery, incident handling and oversight of IT service providers.
SOX ITGC scoping and risk assessment
Deciding which applications, databases, infrastructure, locations and reports fall inside SOX ITGC scope, using the top-down, risk-based approach SEC guidance and PCAOB standards describe.
SOX ITGC testing and evidence
How management and the external auditor test IT general controls and what evidence holds up: walkthroughs, design and operating effectiveness, interim testing and roll-forward, using internal audit, and documentation.
SOX ITGC remediation and material weaknesses
What happens after an ITGC fails: evaluating impact on IT-dependent controls, compensating controls, remediating before year end, auditor communications and disclosure of material weaknesses.
SOX 404 applicability by company type
When SOX 404 and its auditor attestation apply to a company and what changes with filer status, growth, acquisition or regulation: emerging growth companies, accelerated filers, smaller issuers, banks and insurers.
SOX ITGC for cloud and outsourced IT
Running SOX IT general controls when financial systems sit in public cloud, SaaS or with managed providers: what you inherit, what you still own and how auditors get evidence about providers.
SOX ITGC and cybersecurity
Where SOX IT general controls meet cybersecurity: which security controls are in SOX scope, how incidents affect ICFR, and how the SEC's 2023 cybersecurity disclosure rules relate to SOX programs.
SOX ITGC consultants, outsourcing and tools
Who does SOX ITGC work and with what: consultants and co-sourced internal audit, what the external auditor may not do, what management must keep, and open-source tools that produce ITGC evidence.
SOX ITGC guides
Buyer questions about IT general controls under Sarbanes-Oxley: how the ITGC audit works, getting ready before an IPO, what deficiencies mean, and how SOC 1 reports fit in.
