SOX IT controls: what should a startup do in its first 90 days?

In 90 days a startup can scope which systems feed the financial statements, tighten who can access and change them, and start keeping evidence. SOX section 404 requires management to assess internal control over financial reporting, so IT controls matter where systems touch the numbers. Confirm scope with your auditor.

What does SOX actually require?

Section 404(a) of the Sarbanes-Oxley Act directs the SEC to require that each annual report include an internal control report. It states management's responsibility for establishing and maintaining an adequate internal control structure, and assesses the effectiveness of internal control over financial reporting as of the most recent fiscal year end.

Section 404(b) requires the company's auditor to attest to management's assessment, but the statute says this does not apply to emerging growth companies. The SEC's page on emerging growth companies says they may choose not to provide an auditor attestation under 404(b). The status generally lasts five fiscal years after an IPO and ends earlier if revenue reaches $1.235 billion, if the company issues more than $1 billion in non convertible debt over three years, or if it becomes a large accelerated filer.

Under SEC rule 13a-15, management must maintain internal control over financial reporting, evaluate its effectiveness at each fiscal year end with the participation of the principal executive and financial officers, and base the evaluation on a suitable, recognized control framework.

Notice what is missing: none of these texts lists specific IT controls. Teams pick a framework, and auditors then test the controls that matter to the financial statements. The grouping below is common practice, not statutory text.

Days 1 to 30: scope and ownership

Start with a map, not a tool.

1. List the systems that create, change or report financial data: ledger, billing, payroll, expense, data warehouse and the integrations between them.
2. Name a business owner and an IT owner for each.
3. Choose the control framework you will use, with your auditor or finance lead.
4. Record which systems are in scope and why. Out of scope needs a reason too.

Days 31 to 60: access and change

Access and change are common starting points, so cover those next.

• Access. Who can log in, who is admin, and how do joiners, movers and leavers change that? Set a regular review where each owner confirms the access list, and keep the signed review.
• Change. How do code and configuration reach production? Require a ticket, a review by someone other than the author and a record of the deployment. Where a system is a vendor product, record how vendor updates are reviewed.

Software dependencies belong here too. If your billing or reporting code relies on open source libraries, an unreviewed upgrade is a change to a financial system. Keeping an inventory of components and matching it to known vulnerabilities, which Safeguard's SBOM and scanning can produce, gives you a record to point to.

Days 61 to 90: evidence and a dry run

A control that works but leaves no record cannot be shown to anyone.

1. For each control, define the evidence: what it is, where it lives, and who produces it.
2. Collect one full cycle of evidence for access review and change records.
3. Pick a sample of changes and trace each from ticket to approval to deployment.
4. Note gaps and assign owners with dates.
5. Ask your auditor to review the plan before any formal testing.

Safeguard's compliance automation can organize evidence collection. It does not make a company compliant, and Safeguard does not certify SOX readiness. Your management and auditor decide that.

What are the common traps?

• Treating SOX as a one time project. The assessment is annual, so evidence must be continuous.
• Scoping too wide, then drowning in controls that do not touch financial data.
• Relying on informal approvals in chat. Record them where they can be retrieved.
• Letting one engineer both write and release changes to a financial system without a second person.

What to do

1. Draw the system map and name owners this week.
2. Agree the control framework with finance and your auditor.
3. Run the first access review and keep the signed result.
4. Enforce ticketed, reviewed changes for in scope systems.
5. Start an evidence folder with a naming rule and dates.
6. Trace ten sample changes end to end and fix what breaks.
7. Check whether you qualify as an emerging growth company, and what that means for 404(b), with counsel.

Quick check

Sources

• 15 U.S.C. 7262 (SOX section 404), fetched 18 October 2026
• 17 CFR 240.13a-15, fetched 18 October 2026
• SEC: Emerging growth companies, fetched 18 October 2026

This is general information, not legal or audit advice.

Last reviewed: 18 October 2026.