Deciding which applications, databases, infrastructure, locations and reports fall inside SOX ITGC scope, using the top-down, risk-based approach SEC guidance and PCAOB standards describe.
How management and auditors decide which IT general controls are in scope: starting from significant accounts and assertions, finding the automated and IT-dependent controls that matter, and leaving out IT controls that only affect operational efficiency.
Deciding which financial applications, databases, operating systems, directories and network components carry SOX ITGCs, and why the layers under an in-scope application matter when its automated controls or reports are relied on.
How system-generated reports and queries used in controls are tested for completeness and accuracy, why ITGCs over the report source matter, and the IPE gaps PCAOB inspections keep finding in spreadsheets, report writers and custom queries.
How automated application controls are tested once and benchmarked in later years, why that only works when change, access and operations ITGCs are effective, and what evidence (compile dates, stable code, vendor software) supports it.
How SOX ITGC testing is spread across subsidiaries, regions and shared IT or finance service centers: risk-based location selection, entity-level controls for lower-risk units, coordination with internal audit and rotation of testing.
How an acquisition affects SOX ITGC scope on both sides of the deal: the acquirer's one-year exclusion of the target, disclosing material changes, and the access, change and operations gaps a private target should close before its systems enter the next assessment.
The IT risks PCAOB standards name as threats to financial reporting (unauthorized access and changes, inaccurate processing, data loss, manual intervention) and how management maps them to IT general controls instead of running a separate IT review.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.