For SOX, an auditor asks for evidence that the IT controls supporting financial reporting work: who has access, how changes are approved and tested, how systems run and recover, and how reports are produced. Expect to prove completeness and accuracy of system reports. Software cannot make you compliant. It can organize the proof.
Why do IT controls come into SOX at all?
The SEC's 2007 interpretive guidance on management's evaluation of internal control over financial reporting explains it. Controls may be automated, depend on IT functionality, or mix manual and automated steps. The guidance says IT general controls alone ordinarily do not address financial reporting risks, but the proper and consistent operation of automated controls often depends on effective IT general controls. It adds that management only needs to evaluate those IT general controls necessary for other controls to work, and names four areas as examples: program development, program changes, computer operations, and access to programs and data.
So the scope is not "all of IT". It is the part of IT that financial controls lean on.
What changed for auditors?
In June 2024 the PCAOB adopted amendments (Release No. 2024-007). One change to AS 1105 says that when using information produced by the company as audit evidence, the auditor should test the accuracy and completeness of the information, or test controls over it, including, where applicable, IT general controls and automated application controls. The release states an effective date for audits of fiscal years beginning on or after 15 December 2025, subject to SEC approval. We did not confirm approval status, so check it.
In practice, a spreadsheet or report exported from your ERP is evidence only if you can show how it was generated and that it is complete. Expect more questions about reports.
What evidence do auditors ask for?
Requests vary by firm and system. These are common categories, based on the four areas above. Your auditor's request list governs.
Access to programs and data
- User lists with roles for in-scope applications and databases, with dates.
- Evidence of approval for new access and removal for leavers.
- Periodic access review records, signed.
- Privileged and emergency access logs.
Program changes
- A population of changes in the period with ticket, approver, tester and deployer.
- Proof that the person who wrote a change did not alone approve it.
- Test results and rollback plans for sampled items.
Computer operations
- Job scheduling settings and failure handling.
- Backup success records and restore tests.
- Incident tickets for outages affecting financial systems.
Program development
- Project approvals, testing and cutover sign-off for new systems.
Reports
- The query or logic behind each key report, the parameters, and evidence of completeness and accuracy checks.
How do you prepare?
Auditors sample from populations. Be ready to produce a full list for the period, then explain each item they pick. A tidy export with timestamps beats a screenshot. Keep owners clear for each control and rehearse a request: pick a control and ask an engineer to produce the evidence in an hour.
Dependencies and code are part of change management too. An inventory of components and scans that show what shipped and when can support the change story. Safeguard offers compliance automation and mapping, and it does not provide an audit opinion or attest to SOX.
What to do
- Get the auditor's control list and map each control to a system and an owner.
- Identify the key reports your controls rely on and document how each is built.
- Set up scheduled exports of user lists, change populations and job results.
- Run quarterly access reviews and keep signed evidence.
- Enforce separation between author and approver in your code platform.
- Do a mock sample request before the audit and fix what is slow.
Quick check
Which IT areas do SOX auditors usually look at?
Access to programs and data, program changes, computer operations, and program development. The SEC guidance names these as examples, limited to what financial controls depend on.
Why are system reports a bigger topic now?
The PCAOB's 2024 amendments say that when auditors use company-produced information, they test its accuracy and completeness or the controls over it, including IT general controls where applicable.
Sources
- SEC Release 33-8810, Commission guidance regarding management's report on internal control over financial reporting (2007)
- PCAOB Release No. 2024-007, June 12, 2024
Last reviewed: 18 October 2026.
