For a CTO, SOX means that some of your systems are treated as part of the company's financial reporting controls. Management must assess those controls and the external auditor attests to the assessment. Your decisions are which systems are in scope, who owns each IT general control, and how to shrink the surface that an audit has to cover.
What triggers it?
Section 404 of the Sarbanes-Oxley Act, codified at 15 U.S. Code section 7262, requires issuers' annual reports to include a management statement of responsibility for internal control over financial reporting and an assessment of its effectiveness. The registered auditor attests to that assessment, with an exception for emerging growth companies.
A company preparing to go public, or acquired by an issuer, meets this suddenly. It is cheaper to design for it before the first audit season than to retrofit.
How does a platform become in scope?
Finance and audit, not engineering, decide which processes matter. They identify significant accounts and the applications behind them: billing, revenue recognition, the ledger, payroll and any pipeline that transforms their data. IT then enters twice. The applications are in scope. The infrastructure beneath them is too: databases, operating systems, identity, and the deployment tooling that changes the application.
Ask finance for the in-scope application list and map dependencies yourself. A forgotten script that adjusts figures overnight is the typical gap.
What are IT general controls?
Auditors commonly organise IT general controls into access, change management and operations. This grouping is a convention, not statute. Access covers granting, reviewing and removing rights to in-scope systems, including privileged and service accounts. Change management covers requests, testing, approval and release, with a separation between author and approver. Operations covers backup, job monitoring and incident handling.
Automated application controls, such as a rule that blocks an unbalanced journal entry, are separate, and engineering owns their correctness when the code changes.
What do you decide?
Ownership. Name an owner for each control, with a deputy. Controls fail when the owner leaves.
Architecture. Reduce scope on purpose. Fewer in-scope systems means fewer tests. Isolate financial applications, put them in a dedicated environment and limit who deploys to them. A clear boundary is easier to defend than a shared platform where everything is in scope.
Tooling for evidence. Prefer enforcement that leaves records: protected branches, required reviews, deployment logs that cannot be edited, and automated access reports.
Third-party code. Dependency and image updates that reach in-scope systems are changes. Decide how they are reviewed and approved so the control holds for them too.
What is not yours?
You do not rate deficiencies or decide what is disclosed. Management, internal audit and the audit committee do. Your job is to give them accurate facts early, since a deficiency found by you in January is less costly than one found by the auditor in March.
What is the cost of getting it wrong?
An ineffective control can mean a reported deficiency, more testing, more audit fees and management attention. Severe findings become public in filings. The statute and the auditor's standards define the thresholds, so rely on finance and counsel for classification.
How to check or apply this
- Get the in-scope application list and map each dependency.
- Assign owners and deputies for access, change and operations controls.
- Enforce author and approver separation in the pipeline.
- Set log retention to cover the full audit year.
- Isolate in-scope systems to narrow the boundary.
- Define the review path for dependency updates and emergency changes.
- Run a dry audit sample each quarter and fix gaps found.
Quick check
Does SOX apply to private companies?
The statute applies to issuers. Private companies preparing to go public or being acquired by an issuer should plan ahead.
Who decides which systems are in scope?
Management, with finance, internal audit and the external auditor. Engineering supplies the dependency map and the evidence.
Sources
- 15 U.S. Code section 7262, management assessment of internal controls
- COSO internal control guidance
Last reviewed: 18 October 2026.
