SOX IT controls, support your financial audit
Understand which IT systems affect financial reporting and which controls auditors test.
Official sources
Use these official places to read the text and find the latest version.
Official website
The PCAOB sets auditing standards. The SEC enforces the Act. Both publish the rules free.
Visit pcaobus.org ↗Get the document
The Act and PCAOB standards are free to read on official sites.
Open the official page ↗What SOX IT controls is
The Sarbanes-Oxley Act requires US-listed companies to keep reliable financial reporting and test their internal controls every year. IT controls matter because financial systems depend on them.
IT general controls cover access, change management and operations for systems that touch financial data.
How SOX IT controls got to where it is today
The milestones that changed what organisations have to do.
Sarbanes-Oxley Act
Passed after major accounting scandals.
Section 404 applies
Companies begin reporting on internal control over financial reporting.
Risk-based approach
The PCAOB replaces its first auditing standard with a risk-based one that focuses testing on higher risks.
Dates are for orientation. The official website holds the authoritative record.
Do you need it?
If any of these sound familiar, probably yes.
You are or will be a US-listed company.
Your auditor tests IT controls.
You use systems that feed the financial statements.
You are preparing for an IPO.
What it asks of you
The requirements fall into six areas.
Access to systems
Who can reach financial systems.
Change management
Approved, tested changes.
IT operations
Backups, jobs, monitoring.
Segregation of duties
No one person controls a whole process.
Control testing
Test and document each control.
Management reporting
Management certifies controls.
The 6 areas, 12 control areas and 41 requirements and controls
SOX does not list specific IT controls. This page uses the widely accepted four ITGC areas (access, change, development, operations) with the legal basis and framework mappings auditors use; the ITGC reference numbers here are our own labels.
12 control areas · 41 requirements
Legal and audit basisWhat the law and the auditing standard require around internal control over financial reporting.3 control areas · 9 requirements
s302Section 302 Management certificationExecutives certify reports and controls every quarter and year.2 requirements
- SOX s302
The chief executive and chief financial officer certify that they reviewed the periodic report, that it is not materially misleading, and that financial statements fairly present the company.
What you do
- Collect sub-certifications from process and IT owners before sign-off
- SOX s302 controls
Those officers are responsible for establishing and maintaining disclosure controls and internal controls, have evaluated their effectiveness and disclosed significant deficiencies, material weaknesses and any fraud involving management or key employees to auditors and the audit committee.
What you do
- Report ITGC deficiencies up the chain each quarter
Evidence to keep
- Signed certifications
- Disclosure controls evidence
- Sub-certification from control owners
s404Section 404 Internal control over financial reportingManagement assesses and reports on control effectiveness each year; the auditor attests.3 requirements
- SOX s404(a)
Management states its responsibility for adequate internal control over financial reporting and assesses its effectiveness at year end using a recognised framework.
What you do
- Scope key systems that feed the financial statements and document ITGCs for each
- SOX s404(b)
The external auditor attests to and reports on management's assessment for companies that are required to have this attestation, which does not apply to smaller non-accelerated filers.
What you do
- Confirm filer status with finance and plan auditor access to evidence
- SOX s404 ITGC scope
Controls over information technology that support financial reporting are in scope where systems affect the financial statements.
What you do
- List applications, databases, operating systems and interfaces that touch financial data
Evidence to keep
- Management's ICFR assessment report
- Risk and control matrices
- Deficiency evaluation log
- Auditor attestation (where required)
AS2201PCAOB AS 2201 audit of internal controlHow the auditor tests controls, including technology.4 requirements
- AS 2201 top-down
The auditor uses a top-down approach starting with entity-level controls and significant accounts, then selects controls to test.
What you do
- Prepare entity-level and process documentation in the same order
- AS 2201 IT
The auditor considers how information technology affects controls and tests relevant ITGCs and automated controls, and the effect of ITGC weakness on reliance.
What you do
- Provide evidence that ITGCs operate so automated controls can be relied on
- AS 2201 deficiencies
The auditor evaluates deficiencies as control deficiency, significant deficiency or material weakness, considering likelihood and magnitude and compensating controls.
What you do
- Prepare remediation and retest evidence for each deficiency
- AS 2201 service orgs
Where outsourced services affect financial reporting, the auditor considers service auditor reports and the user entity's own controls.
What you do
- Obtain SOC 1 reports from key providers and map complementary user controls
Evidence to keep
- Walkthrough documentation
- Control test results
- Auditor deficiency communications
Access to programs and dataOnly authorised people can use financial systems and data.3 control areas · 9 requirements
ITGC-ACUser access and authenticationControl who gets in and how.4 requirements
- ITGC-AC-01
New access is requested and approved by the business owner before it is granted.
What you do
- Use a ticket with approver and role requested
- Block self-approval
- ITGC-AC-02
Access is removed or changed promptly when staff leave or move.
What you do
- Trigger removal from HR leaver records and reconcile monthly
- ITGC-AC-03
Access rights are reviewed periodically by owners and exceptions are corrected.
What you do
- Run quarterly user access reviews with signed evidence
- ITGC-AC-04
Users are authenticated with enforced password rules and, for remote or privileged access, multi-factor authentication.
What you do
- Apply central password policy and MFA
Evidence to keep
- User lists per system
- Access request and approval tickets
- Password and MFA settings
ITGC-PAPrivileged and segregated accessLimit powerful access and conflicting duties.3 requirements
- ITGC-PA-01
Privileged and administrator access is limited, justified, approved and reviewed more often than ordinary access.
What you do
- Use named admin accounts and vault shared credentials
- ITGC-PA-02
Segregation of duties prevents one person from controlling incompatible tasks, such as creating and approving transactions or developing and releasing code.
What you do
- Define conflicting role pairs and review exceptions
- ITGC-PA-03
Privileged activity and direct changes to financial data are logged and reviewed.
What you do
- Review admin and database logs and alert on direct data changes
Evidence to keep
- Privileged user list
- Segregation of duties rule set
- Privileged activity logs
ITGC-DSData and infrastructure securityProtect the layers that hold financial data.2 requirements
- ITGC-DS-01
Operating systems, databases and networks supporting financial applications are secured and hardened.
What you do
- Apply baselines and patch on a schedule
- ITGC-DS-02
Third-party and generic or service accounts are controlled, with ownership and review.
What you do
- Inventory and review these accounts
Evidence to keep
- Hardening standards
- Network and database security evidence
- Third-party access list
Program change managementChanges to financial systems are authorised, tested and approved.1 control area · 5 requirements
ITGC-CMChange managementEvery production change goes through a controlled process.5 requirements
- ITGC-CM-01
Changes to applications, databases and infrastructure are requested, documented and approved before implementation.
What you do
- Use a change management tool with required approvals
- ITGC-CM-02
Changes are tested and accepted by users before production.
What you do
- Retain test plans and user sign-off
- ITGC-CM-03
Developers cannot promote their own changes to production, enforcing separation between development, testing and production.
What you do
- Restrict deployment rights and use pipeline controls
- ITGC-CM-04
Emergency changes follow a defined path with after-the-fact approval and review.
What you do
- Review all emergency changes within a set time
- ITGC-CM-05
Changes in production are monitored to detect unauthorised change.
What you do
- Compare change tickets to system change logs
Evidence to keep
- Change tickets with approvals
- Test evidence
- Release approval records
- Emergency change log
Program developmentNew systems and major upgrades are built and implemented safely.1 control area · 4 requirements
ITGC-PDSystem development and implementationControl new builds, upgrades and data migrations.4 requirements
- ITGC-PD-01
New systems and major changes follow a documented development or acquisition methodology with approvals at defined stages.
What you do
- Use stage gates covering design, build, test and go-live
- ITGC-PD-02
Testing covers functionality, security, and key calculations and reports, and users formally accept results.
What you do
- Document test cases and results
- ITGC-PD-03
Data conversion and migration are planned, tested and reconciled so data is complete and accurate.
What you do
- Reconcile record counts and balances
- ITGC-PD-04
Access, interfaces and controls are set up and reviewed before go-live.
What you do
- Check roles and interface controls before cut-over
Evidence to keep
- Project approvals
- Requirements and test results
- Data migration reconciliation
- Go-live sign-off
Computer operationsSystems run, recover and are monitored reliably.2 control areas · 4 requirements
ITGC-OPJob scheduling, monitoring and incidentsProcessing completes and problems are handled.2 requirements
- ITGC-OP-01
Batch jobs and interfaces are scheduled, authorised and monitored, and failures are followed up.
What you do
- Alert on job failure and track fixes
- ITGC-OP-02
Incidents and problems affecting financial systems are logged, resolved and escalated.
What you do
- Use a ticketing system with priority and root cause
Evidence to keep
- Job schedules and monitoring reports
- Incident and problem tickets
- Interface monitoring
ITGC-BRBackup and recoveryFinancial data can be restored.2 requirements
- ITGC-BR-01
Financial data and systems are backed up on schedule, failures are resolved and copies are protected.
What you do
- Monitor backup success and keep an offsite or immutable copy
- ITGC-BR-02
Restore capability is tested periodically.
What you do
- Test restores of key databases at least annually
Evidence to keep
- Backup schedules and logs
- Restore test results
- Offsite storage records
COSO and COBIT mappingHow ITGCs connect to the recognised control frameworks used for the assessment.2 control areas · 10 requirements
COSOCOSO 2013 components and principlesThe framework most management teams use to assess ICFR.5 requirements
- COSO P11
The organisation selects and develops general control activities over technology to support achievement of objectives.
What you do
- Document ITGCs as the response to this principle
- COSO P10
The organisation selects and develops control activities that contribute to mitigating risks to acceptable levels.
What you do
- Link ITGCs to specific financial reporting risks
- COSO P12
The organisation deploys control activities through policies that establish what is expected and procedures that put them into action.
What you do
- Maintain written ITGC policies and procedures
- COSO P16
The organisation selects, develops and performs ongoing or separate evaluations to ascertain that components of control are present and functioning.
What you do
- Test ITGCs on a risk-based schedule and track results
- COSO P17
The organisation evaluates and communicates internal control deficiencies in a timely manner to those responsible for corrective action, including senior management and the board.
What you do
- Escalate ITGC deficiencies to the audit committee
Evidence to keep
- Mapping of controls to the 17 principles
- Entity-level control documentation
COBITCOBIT 2019 objectivesCommon IT governance reference used to structure ITGCs.5 requirements
- COBIT BAI06
Managed IT changes: this objective corresponds to the change management ITGC area.
What you do
- Map change controls to BAI06 and BAI07 (acceptance and transition)
- COBIT BAI03
Managed solutions identification and build: this corresponds to program development.
What you do
- Map development controls to BAI03
- COBIT DSS05
Managed security services: this corresponds to access to programs and data.
What you do
- Map access controls to DSS05
- COBIT DSS01
Managed operations: this corresponds to computer operations such as job scheduling and monitoring.
What you do
- Map operations controls to DSS01 and DSS04 (continuity)
- COBIT MEA02
Managed system of internal control: this supports ongoing ITGC monitoring and testing.
What you do
- Use it to structure control self-assessment
Evidence to keep
- Control to COBIT objective mapping
Nothing matches. Clear the search or pick another area.
Outcomes and implementation examples are from Sarbanes-Oxley Act of 2002 (ss. 302 and 404), PCAOB Auditing Standard 2201, COSO Internal Control Integrated Framework (2013), COBIT 2019, published by NIST. Descriptions of what to do and the evidence lists are our own plain-English guidance. Check the official source for the authoritative text.
Your path to getting started
Five steps from first look to ready. Effort depends on your size and starting point.
- 1
Scope systems
Which affect financials.
- 2
Document controls
Owners and frequency.
- 3
Test them
Collect evidence.
- 4
Fix deficiencies
Track to closure.
- 5
Report
To management and auditors.
How Optimus GRC helps
Each area maps to a part of the platform, so the work and the evidence sit together.
| What it asks | What you do in Optimus GRC |
|---|---|
| Access to systems | Access reviews |
| Change management | Change records |
| IT operations | Operations evidence |
| Segregation of duties | Role conflict checks |
| Control testing | Test plans and results |
| Management reporting | Sign-off records |
Free SOX IT controls readiness checklist
A one-page PDF you can print or share with your team. No sign-up needed.
Download the checklist (PDF)- ITGC control matrix
- Access review template
- Change approval template
- Deficiency log
Share or cite this page
Writing about SOX IT controls? You are welcome to link to this guide. Copy the link below.
<a href="/frameworks/sox-it-controls/">SOX IT controls explained in plain English - Optimus CyberX</a>Common questions
Do private companies need SOX?
Not by law, but those preparing to list often prepare.
What are ITGCs?
IT general controls over access, change and operations.
Who tests them?
Internal audit and the external auditor.
Is SOC 2 the same?
No. SOC 2 is a report from a service provider about its own controls. SOX is a US law covering a listed company’s financial reporting.
Related frameworks
See how ready you are for SOX IT controls
Answer questions across every area. We email you a report showing where you comply and where you do not.