SOX IT controls are the general and application controls over the systems that produce a public company's financial statements. They matter because Section 404 requires management to assess internal control over financial reporting, and financial data runs through IT. Public companies need them. Their suppliers feel it through audit requests.
What is SOX in one paragraph?
The Sarbanes-Oxley Act of 2002 sets requirements for US public companies and their auditors. Section 404 requires management to assess and report on the effectiveness of internal control over financial reporting, and the external auditor to attest to that assessment, following Public Company Accounting Oversight Board standards. The Act does not list IT controls directly. IT enters because the controls that protect financial reporting depend on the systems.
We could not retrieve the SEC or PCAOB pages directly, and the sources below are practitioner summaries. Confirm specifics against the Act and PCAOB standards, and with your auditors.
What are IT general controls?
Practitioner sources consistently group IT general controls into four areas:
Access. Who can reach financial systems and data. This covers user provisioning, removal when people leave, privileged access, periodic access reviews and separation of duties.
Change management. How changes to financial applications and infrastructure are requested, approved, tested and deployed. Auditors look for evidence that a change was authorised and tested before production.
Computer operations. Job scheduling, backup and recovery, and incident handling for the systems in scope.
Program development. How new systems or major upgrades are built and implemented.
Application controls sit on top: input checks, automated calculations and reports that rely on system logic.
Who needs them?
Public companies subject to SEC reporting requirements, and the systems that feed their financial statements. Private companies preparing for an IPO, or acquired by a public company, often build the same controls beforehand.
If you are a vendor, SOX does not apply to you directly, but your customer's auditor may ask you about controls over a service that processes their financial data. A SOC 1 or SOC 2 report is commonly used to answer, depending on the service. Check with your customer which they expect.
How does it differ from SOC 2?
SOX is a law about financial reporting integrity. SOC 2 is an attestation about a service organization's controls against trust services criteria. They overlap on access and change management, but they answer different questions to different audiences.
What do auditors test?
Auditors test the design and operating effectiveness of controls across the fiscal year, so a control must run consistently and leave a record. A weak control environment can be a significant deficiency, and a strong indicator of a material weakness. Those are findings with consequences for the company's reporting, which is why finance leaders care.
What does this mean for engineering?
Developers feel SOX through change management: pull request approval, separation between the person who writes code and the person who deploys it, and tickets tied to every production change. Making this automatic, with branch protection and pipeline records, is easier than reconstructing evidence by hand.
What to do
- Identify the systems that feed financial reporting, with your finance team.
- Map access, change, operations and development controls for each.
- Require approval and a ticket link for every production change to those systems.
- Run quarterly access reviews and keep the outputs.
- Separate who can develop from who can deploy where practical.
- Keep evidence for the whole fiscal year, not for the weeks before audit.
- If you are a vendor, ask which report type your customer's auditor expects.
Quick check
Does a startup need SOX controls?
Not until it is public or preparing to be. Many build the basics earlier so audits are easier later.
Is SOX a certification?
No. It is a law. Compliance is shown through management's assessment and the auditor's attestation.
Sources
Last reviewed: 18 October 2026.
