SOX IT controls are the access, change and operations safeguards that make the systems behind your financial reports trustworthy. If a spreadsheet or application produces a number in the financial statements, auditors want proof that only the right people can change it and that changes are approved and tested. This glossary defines the terms you will hear.
This is an explainer, not legal or audit advice. Your auditor decides scope, and Safeguard does not certify anyone for SOX.
Where does SOX come from?
Sarbanes-Oxley Act (SOX). A US law from 2002, Public Law 107-204. Two sections come up most. Section 302 is titled corporate responsibility for financial reports. Section 404 is titled management assessment of internal controls. The law also refers to auditor testing of internal controls under section 404(b), and to describing material weaknesses in those controls.
Internal control over financial reporting (ICFR). The processes that give reasonable assurance your financial statements are reliable. IT controls are one layer of it.
COSO. A framework for designing internal controls. The COSO Internal Control Integrated Framework was issued in 1992 and refreshed in 2013. Many management teams use it to structure their assessment. SOX does not mandate one framework by name in the sections above.
Which control terms matter to engineers?
IT general controls (ITGC). Controls that apply across systems and support the reliability of automated controls and reports. In practice, advisers commonly group them into four areas: access, change management, computer operations and program development. That grouping is common practice, not statute text, so confirm it with your auditor.
Access control. Who gets an account, who approves it, how often it is reviewed and how fast it is removed when someone leaves. Shared admin accounts and unreviewed service accounts are frequent findings.
Change management. How a change moves to production: request, approval, testing, deployment and record. Engineers meet this as pull request review, protected branches and deployment logs. Separation of duties means the person who writes a change is not the only one who approves it.
Computer operations. Job scheduling, backups, restores and incident handling for in-scope systems.
Program development. How new systems or major implementations are built, tested and moved into production.
In-scope system. An application, database or infrastructure component that affects financial reporting. Scope drives everything else, so keep it small and documented.
Which audit terms matter?
Key control. A control the auditor relies on to conclude that a risk is covered.
Walkthrough. The auditor traces one transaction or change from start to finish to confirm you described the control correctly.
Population and sample. The full list of events (all production changes in a quarter) and the subset the auditor tests.
Deficiency, significant deficiency, material weakness. Increasing levels of seriousness for a control failure, with a material weakness the most serious. The law refers to describing material weaknesses in audit reports. Ask your auditor for the exact definitions that apply to you.
Remediation. Fixing a control and showing it worked over a period.
Evidence. Records that prove a control operated: approvals, tickets, logs, review sign-offs, system reports. Evidence should be generated by the system, dated and hard to alter.
Why does software supply chain matter for SOX?
A change to a financial application includes its dependencies. If a build pulls an unreviewed package into a system that computes revenue, your change management story has a hole. An inventory of components, a record of what was approved and a trail of build and deploy events tie the software supply chain back to ITGC.
What to do
- Ask finance and your auditor which systems are in scope. Write the list down.
- Make sure every in-scope change goes through a reviewed pull request and a recorded deployment.
- Run quarterly access reviews for in-scope systems, including service accounts, and keep the sign-offs.
- Remove accounts on the day someone leaves, and keep the ticket.
- Keep dependency inventories and build logs for in-scope applications.
- Collect evidence as the work happens, not in the week before the audit.
Quick check
Are ITGC the same as SOX compliance?
No. ITGC are the IT part of internal control over financial reporting. SOX also covers management certification and the wider control environment.
Does a security certificate satisfy SOX?
Not by itself. Your auditor tests controls over your own financial systems. Other reports may help as supporting information.
Sources
Last reviewed: 18 October 2026.
