Get audit-ready for SOX ITGC
SOX IT Controls · Sarbanes-Oxley IT General Controls
IT general controls required under the Sarbanes-Oxley Act to ensure the integrity and reliability of financial reporting systems, covering access, change management, operations, and program development.
SOX ITGCWhat is SOX ITGC?
IT general controls required under the Sarbanes-Oxley Act to ensure the integrity and reliability of financial reporting systems, covering access, change management, operations, and program development.
Who it applies to
US public companies and their auditors. IT general controls matter here only insofar as they support the integrity of financial reporting, which narrows the scope considerably.
How the standard is organised
Not a published control catalogue but a body of practice around access to programs and data, change management, development and operations, assessed as part of the financial statement audit.
Framework names, marks and abbreviations (ISO, SOC 2, PCI DSS, TISAX, HIPAA, GDPR and others) are trademarks of their respective standards bodies and are used here only to describe what the Bitkosh Readiness Platform helps you track and prepare for. The badges shown are original Bitkosh artwork, not the official marks. Bitkosh Technologies is not affiliated with, sponsored by, or endorsed by ISO, AICPA, the PCI Security Standards Council, ENX/VDA, or any other framework owner, and using this platform does not by itself confer or guarantee certification — certification/attestation is granted only by the relevant accredited third-party body.
SOX ITGC on the Bitkosh platform
The 53 SOX ITGC controls sit in one workspace with gap assessment, evidence collection and your readiness score, and shared controls count towards the equivalent requirement in the other 47 ready frameworks at the same time — so a second framework costs a fraction of the first.
How the platform worksSample controls
Six controls from the platform's control library, chosen because they are the most specific to this framework.
- ITGC-CM-13Rollback and back-out planning
Changes include a documented plan to reverse the change if it fails or causes unexpected effects in production.
Program Change Management - ITGC-GV-03ITGC deficiency tracking and remediation
Control failures are logged, evaluated for their effect on financial reporting, and remediated with tracked actions and owners.
ITGC Governance and Service Organisations - ITGC-GV-06Complementary user entity controls
Controls that a service organisation expects its customers to perform are identified, assigned and operated by management.
ITGC Governance and Service Organisations - ITGC-PD-05Go-live approval and implementation sign-off
A documented go-live decision confirms that testing, training, access setup and conversion are complete before the system is put into production.
Program Development - ITGC-AC-15Direct data and database access restriction
Direct access to production databases and the ability to alter financial data outside the application is limited to authorised support staff and logged.
Access to Programs and Data - ITGC-AC-08Timely access removal for leavers
Access is revoked promptly when employees or contractors leave, with HR notifications triggering account deactivation within a defined timeframe.
Access to Programs and Data
More information security & cybersecurity frameworks
Frequently Asked Questions
Who publishes SOX ITGC, and who does it apply to?
How is SOX ITGC conformance demonstrated?
How is SOX ITGC structured?
Ready to get audit-ready for SOX ITGC?
See how the Bitkosh Readiness Platform gets you audit-ready for SOX ITGC — and the other 47 ready frameworks — from a single control library.