After a SOX audit closes, keep monitoring the IT controls that support financial reporting: access, change management and operations. The SEC expects management to evaluate changes to internal control every fiscal quarter, so the year-end test is not the finish line. Run lightweight checks monthly and keep dated records.
Why does SOX not stop at year end?
Section 404 work has two clocks. The annual one is familiar: management assesses the effectiveness of internal control over financial reporting as of fiscal year end, names the framework it used, and discloses any material weakness. The SEC's rule release also requires management to evaluate any change in internal control that occurred during a fiscal quarter, and to disclose changes that materially affected, or are reasonably likely to materially affect, it.
So a control that quietly stops working in month three is your problem in month three, not in month twelve.
Which IT controls are we talking about?
SOX does not list IT controls itself. In practice auditors look at the systems behind the numbers, and the work is commonly grouped into access, change management, computer operations and system development. Treat that grouping as common practice rather than statute. Your auditor's scoping will tell you which applications and databases are in play.
The framework matters too. The SEC release says a suitable framework must come from a recognized body and states that the COSO framework meets its criteria. It does not mandate COSO, so confirm with your auditor which framework you are documented against.
What does continuous monitoring look like in practice?
Pick the three or four controls whose failure would hurt most and make each one produce a signal on a schedule.
- Access: A monthly report of new, changed and removed accounts on in-scope systems, compared with HR leavers and role changes. Look specifically for privileged accounts that outlived the person.
- Change management: A weekly list of production deployments matched to approved tickets. Anything without a ticket is an exception to explain in writing.
- Operations: Evidence that scheduled jobs, backups and interfaces ran, with failures investigated and closed.
- Software and dependencies: If financial systems are built in house, track the vulnerabilities in their dependencies and the date each one was resolved. An inventory plus reachability analysis keeps the list short enough to act on.
Each check needs an owner, a threshold and a place where the result is stored. A check nobody reads is a record of neglect.
How do we handle exceptions?
Exceptions are normal. What auditors worry about is an exception nobody noticed. For each one, record what happened, who approved the remedy, and the date it was closed. At quarter end, summarize the exceptions and ask one question: did any of this change our internal control in a way we should disclose or at least discuss with the auditor?
What to do
- List the in-scope applications and the IT controls that support them, using your auditor's scoping.
- Choose three or four high-impact controls and assign an owner to each.
- Turn each into a recurring check with a threshold, a schedule and a storage location.
- Compare access lists with HR data every month.
- Match production changes to approved tickets every week.
- Log exceptions with cause, approver and closure date.
- Hold a short quarter-end review and record the change-in-control question and answer.
- Brief your auditor on changes before the next cycle, not during it.
Quick check
Does SOX require a specific IT control framework?
No. The SEC release requires a suitable, recognized framework and says COSO satisfies its criteria, but it does not mandate any one framework.
Is continuous monitoring a legal requirement?
The rule requires management to evaluate changes in internal control each quarter. How you gather evidence between audits is your design choice, and continuous checks are a practical way to do it.
Sources
Last reviewed: 18 October 2026.
