SOX ITGC compliance
Get your IT general controls ready for SOX
Access, change management, and operations controls over the systems behind your financial reporting, evidenced continuously rather than before each test.
What SOX ITGC is
The Sarbanes-Oxley Act of 2002 requires public companies to maintain internal control over financial reporting. Section 404 requires management to assess those controls every year, and for larger filers an external auditor attests to that assessment.
IT general controls are the controls over the systems financial data passes through. Auditors usually group them into access to programs and data, program changes, program development, and computer operations.
When an ITGC fails, the auditor can no longer rely on the automated controls running on that system. A technical gap becomes a financial reporting finding.
Who needs SOX ITGC
You are a public company, you are preparing for an IPO, or a public company relies on your systems for its own financial reporting.
How TrustLynce helps with SOX ITGC
Access to programs and data
User access reviews on in-scope systems, with leavers removed and privileged access justified.
Program change evidence
Code review and approval records pulled from your repositories, so every change to an in-scope system has a trail.
Scope by financial system
Mark which applications, databases, and infrastructure support financial reporting, and keep the rest out of scope with the reason recorded.
Evidence across the period
Controls tested on a schedule, so operating effectiveness is shown across the whole period rather than on the day of testing.
What the audit actually involves
Almost no competitor writes this down. Knowing the shape of it is most of what makes a first audit survivable.
Scope
Identify the financially significant applications and the infrastructure underneath them.
Design and walkthrough
The auditor confirms each control is designed to address its risk and is in place.
Operating effectiveness
Samples are tested across the period to show each control ran as designed.
Deficiency evaluation
Exceptions are classified as a deficiency, a significant deficiency, or a material weakness.
SOX ITGC questions
No. SOC 2 reports on security and related criteria. A service provider whose systems affect a customer's financial reporting usually provides a SOC 1 report, which covers controls relevant to financial reporting.
Section 404 applies to public companies. Private companies usually adopt ITGCs ahead of an IPO, so the first audited year is not also the first year the controls operate.
Internal audit, and the external auditor as part of the financial statement audit. TrustLynce does not audit or attest.
Other frameworks
Evidence collected for one framework carries into the next.
SOC 2
The one your buyers ask for
ISO 27001
Recognised worldwide
HIPAA
Protect health information
GDPR
Handle EU personal data
PCI DSS
Take card payments safely
ISO 42001
Govern how you use AI
NIST CSF
A common security language
CMMC
Work with the DoD
Custom
Your own control set
ISO 27701
Privacy extension to ISO 27001
DORA
EU financial operational resilience
NIS 2
EU critical infrastructure cybersecurity
CCPA / CPRA
California comprehensive privacy
FERPA
Student education privacy standard
FDA 21 CFR Part 11
FDA electronic records & signatures
HDS Certification
French health data hosting certification
HITRUST CSF
Assurance healthcare buyers ask for
FedRAMP
Sell cloud services to US agencies
NIST SP 800-53
The federal security control catalog
NIST SP 800-171
Protect CUI on federal contracts
Find out what your compliance program actually looks like
Thirty minutes, your real systems, no slideware. We'll show you what we'd automate first, and what you don't need us for.