Running SOX IT general controls when financial systems sit in public cloud, SaaS or with managed providers: what you inherit, what you still own and how auditors get evidence about providers.
How SOX ITGC responsibilities split when financial systems run on IaaS such as AWS: provider SOC 1 reports and bridge letters, shared versus customer-owned controls, and the access, change and operations controls that stay with you.
Which IT general controls a company still runs when its ERP, billing or payroll system is SaaS: user access, configuration and interfaces it controls, provider reports it must obtain, and complementary controls the report assumes.
Options when a service provider in the financial reporting process has no usable SOC 1 Type 2: testing your own controls over its output, agreed-upon procedures, testing at the provider, and how gaps affect the assessment.
Whether a provider's SOC 2 report can stand in for a SOC 1 in a SOX program: what each report covers, what the PCAOB standard asks of a service auditor's report, and how companies close the gap with their own controls.
How to review a provider's report for SOX use: coverage period against the assessment date, scope and controls tested, exceptions and opinion, the service auditor's standing, and the procedures needed when time has passed.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.