For SOX, auditors test IT general controls that protect financial systems, usually by sampling. You can automate evidence collection by scheduling exports of access lists, change tickets, approvals and logs into a dated, read only store. Automation makes samples faster to produce, but it does not replace the control itself.
A limit up front: we could not open the PCAOB standard or the SEC page, so the descriptions below come from consultancy and audit firm material found by search. Your auditor and finance team own the interpretation.
What do auditors look at?
Under Section 404, as summarized by secondary sources, management assesses internal control over financial reporting each year, and for larger companies the external auditor attests to that assessment. IT matters because financial applications rest on IT controls. If unauthorized people can reach financial systems, or uncontrolled changes reach production, the application controls above them may be unreliable.
Sources commonly name four domains of IT general controls: access to programs and data, program change management, computer operations, and program development. Auditors test both design and operating effectiveness, which means a control has to work consistently through the fiscal year, not only on audit day.
Typical evidence named in these sources includes population lists, system configurations, access lists and change tickets. One audit procedure example has the auditor sampling account provisioning and termination events to check that access was granted to appropriate roles and removed promptly.
What can you automate?
Access. Scheduled exports of user and role lists from each in scope system, with joiner and leaver records from HR to compare against. The sample question is "show me that this leaver lost access by this date."
Change management. Link each production change to a ticket, an approval and a code review. Pull the list of deployments for the period and match each to its approval. Unmatched deployments are your exceptions to investigate before the auditor does.
Operations. Job run logs, backup success reports and incident tickets.
Development. Pull request approvals, test results and release records.
The pattern is the same each time: define the population, pull it on a schedule, store it unchanged with a timestamp, and compare it to the rule.
Make automated evidence credible
- Store exports somewhere nobody on the control team can edit, and note who ran the pull.
- Keep the query or script under version control so an auditor can see how the population was defined.
- Document completeness: how you know the export contains every record.
- Keep exceptions and how you resolved them, not just clean runs.
Where software supply chain fits
Release evidence increasingly includes what software went into a build. An SBOM stored with each release, and scan results tied to the build, give a dated record of what shipped and which known issues were open. Safeguard generates SBOMs and scans, and its documentation says connectors bring evidence in from the systems you use through OAuth, API token or MCP server, and many of them feed automated compliance tests. We do not claim SOX coverage. Check the framework pages for what is supported, and keep in mind that no tool makes you SOX compliant.
What to do
- Get the list of in scope systems and controls from your finance and audit teams.
- For each control, write down the population, the source and the test.
- Script the exports and schedule them.
- Store results in a write protected location with timestamps.
- Review exceptions monthly, not at year end.
- Walk your auditor through the pipeline once so there are no surprises.
Quick check
Can automation replace the auditor's sampling?
No. It speeds up producing the samples and makes populations complete. The auditor still decides what to test.
What is the most common weak spot?
Per one source, scattered access logs and informal change management turn up as typical early findings. Linking each change to an approval is a good first fix.
Sources
- BD Emerson: SOX 404 compliance, found by search 18 October 2026
- Presencis: Sarbanes-Oxley IT compliance, found by search 18 October 2026
- Safeguard documentation: Compliance, fetched 18 October 2026
Last reviewed: 18 October 2026.
