The most common SOX IT control findings come from user access, especially late removal of leavers, plus unrestricted privileged access, change management without approvals, and evidence that cannot be shown complete. Fix these four areas first and most audit sampling becomes routine.
Why do IT controls matter to a financial audit?
Sarbanes-Oxley section 404 has management assess internal control over financial reporting, and an outside auditor reports on it. Financial reports come out of systems. If anyone can change a system, or its data, without a trace, the automated controls inside it cannot be relied on. IT general controls, or ITGCs, are the layer under everything else: who can get in, how changes reach production, and how the environment is run.
A 2024 KPMG paper, citing an Ideagen Audit Analytics review of SOX 404 disclosures, says IT issues have been among the top internal control problems in recent years and, for the first time, the top issue cited in adverse auditor opinions. That is a reason to look at IT controls early, not at the end of the year.
What do findings usually look like?
There is no single public census of individual findings, so treat this list as recurring themes from advisory and practitioner material, not statistics. KPMG's paper names access control and change management as two of the main drivers.
Leavers and movers keep access. A person is terminated or changes role and their accounts stay live. A common test compares the HR termination list with the system user list, so one dormant admin account can fail the sample.
Privileged access is too wide. Developers with standing production rights, shared admin accounts, and super users nobody reviews. KPMG notes that unrestricted administrative access can have a pervasive effect on other controls because super-user access can bypass them.
Access reviews exist but prove little. A review "happened", yet nobody can show what was reviewed, who signed, or what was removed afterward.
Changes without approval or separation. A change reached production without a recorded approval, or the same person built and released it. Emergency changes are a frequent gap, because they bypass the normal ticket flow and are left out of the log.
Incomplete populations. The auditor samples from a list. If you cannot show that the user report or change log is complete, the sample proves nothing, and the test fails on that alone.
Evidence rebuilt after the fact. Screenshots taken the week before fieldwork are weaker than records generated when the event occurred.
How do software supply chain practices fit in?
Change management now covers more than your own code. A new open source package entering the build is a change to a financial system. Teams that record dependency changes, approvals and scan results in the pull request have a ready answer when the auditor asks for the population of changes. Compliance automation tools, Safeguard's included, can collect that evidence continuously, but the control design and the sign-off remain yours.
What to do
- Pull the HR leaver list for the year and compare it to every in-scope system's user list. Close gaps now.
- List every privileged account, name an owner for each, and remove shared logins.
- Run a quarterly access review that records the reviewer, the date, the accounts removed and the ticket showing removal.
- Require an approved ticket for every production change, including emergency changes, with a retrospective approval inside a set number of days.
- Make sure no one both writes and releases the same change to production.
- Confirm that your user and change reports are complete, and keep the query or export method on file.
- Collect evidence as it is generated, with timestamps, rather than rebuilding it later.
Quick check
What is the difference between an ITGC and an application control?
An ITGC supports the environment: access, change, development and operations. An application control sits inside a system, such as a three-way match. Auditors rely on application controls only if the ITGCs around them work.
Does a SOC 2 report replace SOX testing?
No. They have different purposes. A SOC 2 report from a vendor can support your assessment of that vendor, but your own financial reporting controls still need your own testing.
Sources
- SEC: Management's Report on Internal Control Over Financial Reporting, Release 33-8238
- KPMG: The increasing importance of IT controls in ICFR, April 2024 (PDF)
Last reviewed: 18 October 2026.
