SOX ITGC audit
How IT general controls are assessed by management and tested by the external auditor under SOX Section 404: who must comply, what the auditor tests, and how ITGCs support automated controls.
SOX ITGC guides
Buyer questions about IT general controls under Sarbanes-Oxley: how the ITGC audit works, getting ready before an IPO, what deficiencies mean, and how SOC 1 reports fit in.
SOX ITGC readiness before an IPO
When a newly public company's SOX 404 obligations start, what the transition rules and emerging growth company status allow, and what IT general controls need to be in place and evidenced before then.
SOX ITGC deficiencies
How IT general control failures are classified as deficiencies, significant deficiencies or material weaknesses, what each means for disclosure, and how auditors weigh ITGC failures against automated controls.
SOC 1 vs SOX ITGC
How a service organization's SOC 1 report relates to a public company's own SOX IT general controls, what management and auditors can rely on, and where the company's own controls are still required.
SOX 404 compliance cost and the share spent on IT controls
What Section 404 compliance costs and why: the SEC's published survey figures for total cost, audit fees and outside vendor fees, the 2020 estimate of 404(b) savings, internal labor as the largest component, and the drivers DeployOpen scopes for ITGC work.
SOX ITGC checklist by control area
A working checklist of the IT general controls auditors commonly test across access, program changes, program development and computer operations, tied to the IT risks PCAOB standards name and to the evidence management keeps.
SOX 302 vs 404: officer certifications and ICFR reports
How Section 302 certifications differ from the Section 404 ICFR report and auditor attestation: who signs, how often, what each says about internal control, when newly public companies can omit ICFR language, and how Section 906 adds criminal penalties.
SOX record retention requirements for IT and audit evidence
What Sarbanes-Oxley actually says about keeping records: the Section 802 criminal provisions, the auditor's seven-year workpaper rule, management's duty to keep evidence supporting its ICFR assessment, and what that means for log and ticket retention.
