Who does SOX ITGC work and with what: consultants and co-sourced internal audit, what the external auditor may not do, what management must keep, and open-source tools that produce ITGC evidence.
What SOX ITGC consultants and implementation partners do (scoping, control design, remediation, evidence, testing support), what the SEC's survey found companies paid outside vendors, and the independence line with the external auditor.
What the company's own audit firm may and may not do on IT general controls under SEC independence rules: system design and operation, internal audit outsourcing, management functions, and management's representation that it did not rely on the auditor.
When to bring in an outside firm for SOX ITGC testing: how external auditors use others' work, competence and objectivity tests, the bar on using the audit firm itself, and inspection findings on over-reliance.
A split of SOX ITGC work between control owners, management, an implementation partner and the auditors: responsibilities that stay with management, work partners commonly take on, and keeping both evaluators and auditors independent.
Self-hosted open-source tools that run or evidence common ITGCs (identity and SSO, access reviews, privileged access, change tickets, file integrity, backups, GRC tracking), their licenses, and how their reports must still pass IPE testing.
How automated monitoring and system reports can carry more of the SOX ITGC evidence load: what SEC guidance says about on-going monitoring, how auditors treat automated controls and system-generated reports, and where automation still needs testing.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.