SOX compliance · Free audit · No signup

SOX §404 ITGC + Policy Audit

Grade your information security and IT General Controls policies against SOX §302, §404, and §906 — access provisioning, change management, computer operations, backup/recovery, and segregation of duties. Get the exact policy text + control activities to add before your external auditor walkthrough.

Run free SOX audit
Sarbanes-Oxley Act of 2002 (15 U.S.C. §7201 et seq.) · All U.S. public companies + foreign issuers on U.S. exchanges; auditors of public companies

What SOX non-compliance actually costs

$5M + 20 yrs
CEO/CFO false certification (§906) — willful
18 U.S.C. §1350
Up to $5M + 20 yrs
Document destruction (§802)
18 U.S.C. §1519
$1.27M+ corp / $254K individual (2025)
SEC civil penalty (per violation)
Inflation-adjusted under SEC Rule 1001
$7B+ combined
Lehman / Worldcom / Enron era settlements
Triggered SOX itself; restated financials + delisting still ongoing risk

Who must comply with SOX?

What this audit checks

12 required clauses, scored as Present / Partial / Missing with the exact regulatory citation and suggested fix.

1
CEO + CFO §302 quarterly certification process
Sub-certification cascade documented — process owners attest before CEO/CFO sign
2
§404(a) management assessment of ICFR
Annual assertion in 10-K — must cover design + operating effectiveness
3
§404(b) external auditor attestation (non-accelerated filers exempt)
Accelerated + large accelerated filers — auditor opinion on ICFR
4
IT General Controls (ITGC) — Access provisioning + termination
Background of every COSO finding — new hire, transfer, termination workflow with evidence
5
ITGC — Periodic access review (quarterly or semi-annual)
Privileged + financially-significant application access reviewed + attested by owner
6
ITGC — Change management with segregation of duties
Developer ≠ approver ≠ deployer; emergency change process documented
7
ITGC — Computer operations (backup, job monitoring, incident)
Batch failure detection + remediation, restore testing evidence
8
Logical access — MFA + least privilege to in-scope systems
GL, sub-ledgers, billing, payroll, treasury — and the underlying DBs / OS / cloud accounts
9
Application controls (ITAC) — automated 3-way match, edit checks
Tied to specific financial assertions (completeness, accuracy, validity)
10
End-User Computing (EUC) governance for spreadsheets
Key spreadsheets used in financial reporting — version control, formula protection, review evidence
11
Vendor SOC 1 Type II review for outsourced processes
Material service organizations — CUEC mapping + bridge letters covering gap periods
12
Whistleblower hotline + anti-retaliation (§806 / §301)
Independent audit committee channel — confidential + anonymous reporting
Audit my policy now
Results in 20 seconds · 3 free per day · No signup

Why SOX audits actually fail

ITGC deficiencies aggregated into a material weakness
Individually 'low severity' findings — missing terminations, undocumented changes, weak EUC controls — get aggregated by your external auditor into a Significant Deficiency or Material Weakness once they cross 5% of pretax income materiality.
Privileged access to financial systems with no quarterly review
PCAOB inspections cite this every year. Domain admins, DBAs, and cloud root accounts all need documented quarterly review with evidence retained 7 years.
Change management with no traceability
Auditor samples 25–60 changes per app and traces each to an approved ticket, code review, test evidence, and production deployer who is NOT the developer. Missing one breaks the population.
EUC spreadsheets feeding the GL
Most companies still have key reserves, tax, or revenue-recognition spreadsheets with no version control, formula protection, or independent review. Auditors are increasingly testing these directly.

SOX FAQ

Are private companies subject to SOX?
Most SOX requirements apply only to public filers. However §802 (document destruction), §806 (whistleblower retaliation), and §1107 are criminal statutes that apply to ALL entities. Private companies preparing for IPO must achieve SOX-readiness 12–18 months pre-listing.
What is the difference between §302 and §404?
§302 = quarterly CEO/CFO certification of disclosure controls (DCP). §404 = annual management assessment of internal controls over financial reporting (ICFR), with auditor attestation for accelerated filers. §404 is where ITGC + ITAC live.
How does cloud (AWS / Azure / GCP) affect SOX scope?
Cloud doesn't eliminate ITGC — it changes the operator. You rely on the provider's SOC 1 Type II for the controls they manage (data center, hypervisor) and you remain responsible for everything 'above the line' — IAM, encryption keys, configuration, logging, change management. Map Complementary User Entity Controls (CUECs) explicitly.

Grade your policy in 20 seconds

Paste your existing document. Get a 12-clause SOX scorecard. Generate a fully compliant version for $9 if you don't want to fix it manually.

Run free SOX audit