SOX Compliance Checklist: IT Controls for Internal Assessment

The Sarbanes-Oxley Act holds management of US public companies responsible for the accuracy of financial reporting, and Section 404 requires them to assess their internal controls every year. For IT teams, that means proving that the systems behind the numbers are controlled: who can change data, how changes reach production, and how problems are detected.

Who it is for: public companies and companies preparing for an IPO, their finance and internal audit teams, and the IT and DevOps teams that run financial systems.

Here’s a summary of what needs to be done to ensure compliance with SOX:

1. Data Integrity: Implement measures to prevent financial data tampering.
2. Audit Timeline: Establish and adhere to a clear audit schedule.
3. Data Access Controls: Verify who has access to what data and ensure accountability.
4. Ongoing Monitoring: Regularly test the effectiveness of internal controls, not just during audits.
5. Fraud Detection: Implement processes for identifying and responding to fraud attempts.
6. Security Breach Reporting: Ensure transparency in reporting any security breaches.
7. Automation: Implement automated controls wherever possible to enhance reliability and accuracy.
8. Risk Assessment: Regularly assess risks to identify new or emerging threats to financial reporting.

Where IT teams usually struggle: access reviews that are done but not documented, emergency changes that bypass approval, and controls tested once a year instead of continuously. Automated evidence collection in your CI/CD and cloud environment closes most of these gaps.

How to use it: use the checklist for an internal assessment before your external audit, or to agree priorities between finance and IT. Our guide to SOX compliance covers the requirements in more depth, and our compliance audit team can review your IT general controls.

Frequently Asked Questions

Which SOX sections matter most for IT?

Section 302, which requires executives to certify financial reports, and Section 404, which requires an annual assessment of internal controls over financial reporting, including IT general controls.

What are IT general controls (ITGCs)?

The controls over access to systems and data, change management, and IT operations that auditors test to confirm financial data can be trusted.

*This checklist is provided for informational purposes only and does not constitute legal advice.