SOX does not contain an IT checklist. Section 404 requires public companies to report on management's assessment of internal control over financial reporting, with an auditor attesting to it. IT controls matter because the systems that produce the numbers must be trustworthy. Your first job is to find those systems.
What does the law actually say?
The Sarbanes-Oxley Act of 2002, Section 404(a), directs the SEC to require an annual report that states management's responsibility for an adequate internal control structure and procedures for financial reporting, and contains an assessment of their effectiveness at fiscal year end. Section 404(b) says the registered accounting firm that audits the company must attest to and report on management's assessment.
Nothing in that text names passwords, patching or backups. IT enters through the question "can we trust the systems that create and change financial data?" How an auditor answers that comes from auditing standards and the firm's methods, so confirm the detail with your auditor.
Which systems are in scope?
Start from the financial statements, not from the network diagram. Ask finance which applications produce or alter numbers: the general ledger, billing, payroll, revenue systems, expense tools, consolidation spreadsheets. Then ask which databases, integrations, cloud accounts and identity systems sit underneath them.
A company's ticketing tool is probably out. The scheduled job that posts invoices to the ledger is probably in. If you cannot tell, ask the controller and write down the answer.
What do auditors typically look for?
Practice commonly groups general IT controls into access management, change management and operations such as backup and job scheduling. This grouping comes from audit practice rather than from the statute, so treat it as a working guide and check it with your auditor. In each area they sample evidence: who was granted access and who approved it, which changes reached production and who reviewed them, and whether failed jobs were noticed.
A constructed example
A company's billing system calculates revenue and writes entries to the ledger through a nightly job. The auditor samples ten changes to the job's code. Nine have a reviewed pull request. One was an emergency fix deployed by a single engineer with no later review. The team had a policy for emergencies, but no record that the review happened afterward. The finding is not about the code. It is that the control had no evidence.
What to do
- Ask finance for the list of systems that produce or change reported numbers.
- Meet the external auditor or internal audit lead early, and learn how they define scope.
- Map each in-scope system to its owner, administrators and hosting.
- Review who has privileged access in each system, and remove those who no longer need it.
- Make sure production changes to in-scope systems have a reviewed, recorded approval, including an after the fact review for emergencies.
- Confirm that backups and scheduled financial jobs have monitoring and a named responder.
- Keep dated evidence in one place, and note who collected it.
- Do not touch controls that auditors have already tested without telling them.
Safeguard can show which dependencies and components sit in the software that feeds these systems, and its policies and gates can enforce review rules in code. Auditor attestation is separate.
Quick check
Does SOX require specific security tools?
No. The statute requires management's assessment of internal control over financial reporting and an auditor's attestation. It does not list tools.
Why do IT controls matter for SOX?
Because financial data lives in systems. If access or changes are uncontrolled, the numbers are harder to trust.
Sources
Last reviewed: 18 October 2026.
