Cyber Audit Authority

SOX IT and Cybersecurity Audit Controls

The Sarbanes-Oxley Act of 2002 (SOX) imposes financial reporting integrity requirements on publicly traded companies in the United States, and the IT controls that protect financial data systems are central to SOX compliance. Section 404 of the Act specifically mandates management assessment and external auditor attestation of internal controls over financial reporting (ICFR), which increasingly encompasses cybersecurity infrastructure. This page covers the structure of SOX IT and cybersecurity audit controls, how they are assessed, the scenarios in which they apply, and how auditors and compliance officers determine scope and sufficiency.

Definition and scope

SOX IT audit controls refer to the formal evaluation of technology systems, access configurations, and cybersecurity measures that underpin the accuracy and integrity of a public company's financial statements. Under Section 404 of the Sarbanes-Oxley Act (15 U.S.C. § 7262), management must annually assess and report on the effectiveness of ICFR, and external auditors registered with the Public Company Accounting Oversight Board (PCAOB) must independently attest to that assessment for accelerated filers.

The scope of SOX IT controls is not defined by a single cybersecurity standard. Instead, the PCAOB Auditing Standard No. 2201 (formerly AS 5) governs the integrated audit of ICFR and directs auditors to evaluate IT general controls (ITGCs) and application controls as part of the broader internal control framework. ITGCs cover four principal domains:

  1. Access controls — Who can read, modify, or delete financial data and supporting systems
  2. Change management — How modifications to financial applications and underlying infrastructure are authorized and tested
  3. Computer operations — Backup, recovery, batch job integrity, and system availability
  4. Program development — Procedures for developing and implementing new financial systems

Cybersecurity controls intersect with SOX wherever a breach, unauthorized modification, or system compromise could materially affect the reliability of financial reporting. The Committee of Sponsoring Organizations of the Treadway Commission (COSO) Internal Control — Integrated Framework (2013) provides the predominant conceptual model for structuring these assessments.

How it works

SOX IT audits follow a risk-based, top-down methodology anchored in PCAOB AS 2201. The process moves from entity-level controls down to specific transaction cycles and the IT systems that support them.

Phase 1 — Scoping
Auditors identify in-scope systems by tracing financial reporting processes to the IT applications and infrastructure that generate, process, store, or transmit material financial data. A payroll system, ERP platform (such as SAP or Oracle Financials), or consolidation tool feeding into SEC filings is in scope; an internal HR scheduling tool typically is not. Cybersecurity audit scope definition decisions at this stage determine the entire audit's coverage.

Phase 2 — ITGC Assessment
Auditors test the four ITGC domains against control objectives. For access controls, this includes reviewing provisioning logs, segregation of duties matrices, and privileged access reviews — areas also examined in privileged access audits and identity and access management audits.

Phase 3 — Application Control Testing
Application controls — automated validations, input edits, and processing controls embedded within financial software — are tested for configuration accuracy and tamper resistance.

Phase 4 — Deficiency Classification
Control gaps are classified as control deficiencies, significant deficiencies, or material weaknesses. A material weakness in ICFR requires disclosure in the company's annual report (Form 10-K) under SEC Rule 13a-15, which can trigger immediate stock price effects and SEC inquiry.

Phase 5 — Attestation and Reporting
Management issues its Section 404(a) report; external auditors issue the Section 404(b) attestation. PCAOB-registered firms must comply with AS 2201 throughout, with findings documented in the integrated audit opinion.

Common scenarios

Scenario 1: ERP access control failure
An audit reveals that 47 user accounts in a company's Oracle Financials system retain active posting privileges after the employees were terminated. This constitutes a failure in the access control ITGC domain and, depending on materiality, may rise to a significant deficiency or material weakness.

Scenario 2: Unauthorized change to financial reporting logic
A configuration change to a revenue recognition module is deployed without passing through the formal change management process. The absence of documented approval and testing documentation creates an ITGC deficiency in the change management domain.

Scenario 3: Ransomware impact on financial close
A ransomware incident encrypts a company's financial consolidation system for 11 days during the fiscal year-end close period. SOX auditors must assess whether backup and recovery controls functioned as designed and whether the delay created conditions for data manipulation or reporting inaccuracy.

Scenario 4: Cloud migration without updated controls
A company migrates its general ledger from an on-premise system to a cloud ERP without updating its SOX control narratives or performing cloud security audits. Auditors identify gaps between documented controls and the actual cloud-hosted environment.

Decision boundaries

Determining whether a cybersecurity control falls within SOX scope requires applying a two-part test: (1) does the system directly support a financial reporting process, and (2) could a failure in that control materially misstate financial results?

Controls that fall inside SOX scope:
- Access and authentication controls on general ledger, accounts payable, accounts receivable, and payroll systems
- Encryption and integrity controls on data feeds between financial systems and SEC reporting tools
- Audit logging on databases containing financial transaction records
- Disaster recovery and business continuity controls for financial close processes

Controls that fall outside SOX scope (absent indirect financial impact):
- Cybersecurity controls on customer-facing e-commerce platforms (unless revenue recognition data flows directly into ICFR-relevant systems)
- Endpoint security on non-financial workstations
- Network perimeter controls not associated with financial data segments

A critical distinction separates SOX IT audits from broader cybersecurity compliance frameworks. SOX cybersecurity audits are not equivalent to NIST CSF alignment assessments or SOC 2 audits. SOC 2 addresses service organization trust principles for customer data; SOX ICFR addresses financial statement reliability for investors and regulators. An organization may pass a SOC 2 Type II examination while still carrying material weaknesses in SOX IT controls if financial application access is not properly governed.

Auditor qualification also differs across these frameworks. SOX ICFR attestations must be performed by PCAOB-registered audit firms, a requirement that does not apply to SOC 2 or NIST-based reviews. Professionals performing supporting IT audit work often hold certifications such as CISA (Certified Information Systems Auditor) from ISACA, though PCAOB registration governs the attestation function itself.

The frequency of SOX IT control testing aligns with the annual 10-K reporting cycle, but many accelerated and large accelerated filers conduct quarterly interim testing to identify deficiencies before year-end. Cybersecurity audit frequency and scheduling practices for SOX engagements are shaped by control risk ratings established during scoping.

References

In the network

Network