A clean SOX audit describes the last year. To stay clean, test your own IT general controls on a schedule, track every exception to closure, and gate changes to in scope systems so scope does not drift. Quarterly self tests of access, change and operations controls are enough for most teams, provided you write down the results.
Why do clean programmes slip?
Section 404 of the Sarbanes-Oxley Act, codified at 15 U.S.C. 7262, asks management to assess the effectiveness of internal control over financial reporting as of fiscal year end, every year. The assessment is not a point in time that you pass once. Staff turn over, systems are replaced, a finance team adopts a new tool, and last year's tested controls are quietly different this year.
The statute does not describe ITGCs. They are the common practice for scoping the technology controls that support financial reporting, and the PCAOB standard page was blocked when we tried to fetch it on 18 October 2026. Confirm scope details with your external auditor.
What should you watch continuously?
Access. Joiners, movers and leavers are the highest risk and the easiest to monitor. Match HR termination data to identity provider disablements weekly. Alert on new privileged accounts and on use of shared or break glass accounts, and make each use produce a ticket.
Changes. Make it impossible, or at least visible, to deploy to in scope systems without a linked approved change. Monthly, compare the production deployment list to the change tickets and investigate every orphan.
Operations. Watch job and interface failures, backup completion and restore tests. Failures that affect financial data need tickets with resolution notes.
Scope. Every time finance adds an application, spreadsheet, script or data feed, ask whether it affects financial reporting. A short scope review at month end catches most surprises.
What cadence works?
Weekly: terminated user match, privileged account alerts and open failure tickets.
Monthly: change population against approvals, job and backup review, scope questions from finance.
Quarterly: user access review for each in scope system, with named reviewer, decisions and removals recorded. Also run a self test: pick a sample for each key control, trace it end to end and record pass or fail.
Annually: refresh the control inventory, retire controls that no longer apply, document control changes from the year and run a readiness check three months before the auditors arrive.
What does a good exceptions log look like?
One line per exception: date found, system, control, what happened, risk, fix, owner, closure date and the evidence of closure. Reviewing it monthly with IT and finance shows an auditor that the control environment monitors itself. Deficiencies you found and fixed before they did are worth far more than ones they found first.
How do you handle tool and process changes?
Treat any change to an in scope system, such as a new identity provider, a migration of the deployment pipeline or a new ERP module, as a project with a control review. Write down which controls change, who owns them, and what evidence continues across the cutover. Keep logs from both systems for the transition period so a sample falling in that window can still be traced.
What mistakes recur?
- Access reviews that become rubber stamps because the reviewer cannot tell what the permissions mean.
- Deferring terminated user cleanup until the quarterly review.
- Emergency changes that never get retrospective approval.
- Control owners who left and were not replaced.
- Evidence stored in personal folders that vanish with the person.
- Forgetting that spreadsheets and scripts feeding financial data count as systems.
What to do
- Keep a control inventory with owner, frequency and evidence location for each ITGC.
- Automate the weekly terminated user match and privileged account alerts.
- Reconcile production deployments to approved changes every month.
- Run quarterly access reviews and a self test of one sample per key control.
- Keep one exceptions log and review it monthly.
- Add a scope question to the month end close checklist.
- Hand over every control when owners change roles.
- Book a readiness review before audit planning starts.
Quick check
How often should we self test ITGCs?
The law asks for an annual assessment, and most teams find quarterly self tests practical because they catch decay while there is still time to fix it. Agree the cadence with your auditor and internal audit.
What is the first sign of drift?
Usually a mismatch between lists: terminated employees against active accounts, or deployments against change tickets. Compare those lists regularly.
Sources
- 15 U.S. Code 7262, management assessment of internal controls, fetched 18 October 2026.
How Safeguard helps automate this
Staying clean means repeating the same checks without fail. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of screenshots, and monitoring runs continuously between audits, leaving your team time for other work. Technical evidence comes from your real code and dependencies: scans, SBOMs and reachability. The remediation agent can open tested fix pull requests for vulnerable dependencies and other findings. It is off by default, every category starts on Manual, and you choose which categories run automatically and set the approval level. Your external auditor still performs the audit. Book a call to see how it works.
Last reviewed: 18 October 2026.
