Question 1

What are IT General Controls (ITGCs) under SOX?

Accepted Answer

ITGCs are the foundational technology controls that support the integrity of financial reporting systems. They cover four domains: access to programs and data (who can access financial systems and data), program changes (how changes to financial applications are developed, tested, and deployed), computer operations (job scheduling, backups, incident management), and program development (how new financial applications are built and validated). External auditors evaluate ITGCs as part of their SOX 404 assessment because weaknesses in these controls can undermine the reliability of financial data.

Question 2

We are planning an IPO. When should we start SOX preparation?

Accepted Answer

Start 12 to 18 months before your expected IPO date. You will need that time to design controls, implement them, document operating procedures, and build a track record of operating effectiveness that your external auditor can test. Companies that wait until after going public face compressed timelines, higher costs, and the risk of material weaknesses in their first SOX assessment.

Question 3

How does SOX relate to SOC 1 and SOC 2?

Accepted Answer

SOC 1 reports (formerly SAS 70) specifically address controls relevant to financial reporting, making them directly applicable to SOX compliance. If your organization is a service provider to publicly traded companies, your clients' auditors will likely request a SOC 1 Type II report as evidence that your controls support their SOX requirements. SOC 2, while broader in scope, covers overlapping controls (particularly access management and change management) that can serve double duty.

Question 4

What happens if our external auditor identifies ITGC deficiencies?

Accepted Answer

ITGC deficiencies are classified as control deficiencies, significant deficiencies, or material weaknesses depending on severity. Material weaknesses must be disclosed publicly in your annual report and can impact investor confidence and stock price. We help organizations rapidly remediate identified deficiencies, draft management responses, design compensating controls where needed, and build sustainable processes that prevent recurrence.

SOX ITコンプライアンス

対象となる方

提供内容

よくあるご質問

ペネトレーションテストでSOX ITコンプライアンスコンプライアンスを強化する

始める準備はできましたか？