cloudthinker-ai SOX IT Controls Audit
Phase 1: Scope Definition
- Identify in-scope systems for financial reporting
- ERP / financial accounting systems
- Billing and revenue systems
- Payroll systems
- Reporting and consolidation tools
- Supporting infrastructure (databases, OS, network)
- Cloud platforms hosting financial applications
- Map IT dependencies for each material business process
- Define control objectives per system
- Identify key reports and interfaces
System Scoping Matrix
| System | Business Process | Material Account | ITGC Categories | Risk Rating |
|---|---|---|---|---|
| AC/CM/CO/PD | High/Med/Low |
Phase 2: Access Control Testing (AC)
- Test logical access controls
- AC-1: New user access provisioning follows approval process
- AC-2: User access is based on role/job function (least privilege)
- AC-3: Terminated users removed within defined timeframe
- AC-4: Periodic access reviews performed (quarterly/semi-annually)
- AC-5: Privileged/admin access restricted and monitored
- AC-6: Password policies enforce complexity and rotation
- AC-7: Segregation of duties enforced in financial systems
- AC-8: Service accounts managed and reviewed
- Sample and test user provisioning and deprovisioning
- Review privileged access logs
- Test segregation of duties conflicts
Phase 3: Change Management Testing (CM)
- Test change management controls
- CM-1: Changes follow documented approval process
- CM-2: Changes tested before production deployment
- CM-3: Separation of development and production environments
- CM-4: Emergency changes follow expedited approval process
- CM-5: Developer access to production restricted
- CM-6: Changes to databases and infrastructure follow process
- CM-7: Version control and rollback procedures exist
- Sample and test change records for proper approvals
- Verify test evidence for sampled changes
- Review emergency change documentation
Phase 4: Computer Operations Testing (CO)
- Test IT operations controls
- CO-1: Batch jobs/scheduled tasks monitored for completion
- CO-2: Job failures investigated and resolved timely
- CO-3: Data backups performed per schedule
- CO-4: Backup restoration tested periodically
- CO-5: Incident management process followed
- CO-6: System availability monitored against SLAs
- CO-7: Physical/environmental controls adequate
- Review batch job monitoring logs
- Verify backup and restoration test evidence
- Review incident records for operational issues
Phase 5: Program Development Testing (PD)
- Test program development controls
- PD-1: SDLC methodology documented and followed
- PD-2: Requirements documented and approved
- PD-3: User acceptance testing performed
- PD-4: Data migration validated for system implementations
- PD-5: Post-implementation review completed
- Sample and test new system implementations
- Verify project documentation and approvals
Control Testing Summary
| Category | Controls Tested | Effective | Deficiency | Material Weakness |
|---|---|---|---|---|
| Access Controls (AC) | ||||
| Change Management (CM) | ||||
| Computer Operations (CO) | ||||
| Program Development (PD) | ||||
| Total |
Phase 6: Deficiency Assessment & Reporting
- Classify identified deficiencies
- Control deficiency: control does not operate effectively
- Significant deficiency: reasonable possibility of material misstatement not prevented
- Material weakness: reasonable possibility of material misstatement not prevented or detected
- Develop remediation recommendations
- Prepare management response for each finding
- Report to audit committee
Counter-Rationalizations
| Shortcut | Counter | Why |
|---|---|---|
| "We can skip some steps for this case" | Adapt the workflow steps, don't skip them | Skipped steps are where incidents and oversights originate |
| "The user seems to already know what to do" | Complete all workflow phases with the user | The workflow catches blind spots that experience alone misses |
| "This is a minor case, full process is overkill" | Scale the process down, don't turn it off | Minor cases become major when unstructured; the process scales, not disappears |
| "I'll fill in the details later" | Complete each section before moving on | Deferred details are forgotten; real-time capture is more accurate |
| "The template output isn't necessary" | Always produce the structured output format | Structured output enables comparison, audit trails, and handoff to other teams |
Output Format
- Scoping Document: In-scope systems and control objectives
- Test Work Papers: Evidence and results per control
- Deficiency Report: Classified findings with root cause
- Remediation Plan: Corrective actions with owners and deadlines
- Management Letter: Summary of findings for leadership
Action Items
- Finalize system scoping with external auditors
- Complete access control testing for all in-scope systems
- Test change management sample for the audit period
- Verify computer operations controls and evidence
- Classify all deficiencies found
- Develop remediation plans for each deficiency
- Present findings to audit committee