# Sox It Controls Audit

> Use when performing sox it controls audit — conducts an IT general controls audit for Sarbanes-Oxley (SOX) compliance, covering access management, change management, computer operations, and program development controls for systems involved in financial reporting. Includes ITGC testing procedures and deficiency classification.

- Skill: `cloudthinker-ai/sox-it-controls-audit` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cloudthinker-ai/sox-it-controls-audit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cloudthinker-ai/sox-it-controls-audit/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: cloudthinker-ai (https://skillmd.com/u/cloudthinker-ai)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/cloudthinker-ai/sox-it-controls-audit

---


# SOX IT Controls Audit

## Phase 1: Scope Definition
1. Identify in-scope systems for financial reporting
   - [ ] ERP / financial accounting systems
   - [ ] Billing and revenue systems
   - [ ] Payroll systems
   - [ ] Reporting and consolidation tools
   - [ ] Supporting infrastructure (databases, OS, network)
   - [ ] Cloud platforms hosting financial applications
2. Map IT dependencies for each material business process
3. Define control objectives per system
4. Identify key reports and interfaces

### System Scoping Matrix

| System | Business Process | Material Account | ITGC Categories | Risk Rating |
|--------|-----------------|------------------|----------------|-------------|
|        |                 |                  | AC/CM/CO/PD    | High/Med/Low |

## Phase 2: Access Control Testing (AC)
1. Test logical access controls
   - [ ] AC-1: New user access provisioning follows approval process
   - [ ] AC-2: User access is based on role/job function (least privilege)
   - [ ] AC-3: Terminated users removed within defined timeframe
   - [ ] AC-4: Periodic access reviews performed (quarterly/semi-annually)
   - [ ] AC-5: Privileged/admin access restricted and monitored
   - [ ] AC-6: Password policies enforce complexity and rotation
   - [ ] AC-7: Segregation of duties enforced in financial systems
   - [ ] AC-8: Service accounts managed and reviewed
2. Sample and test user provisioning and deprovisioning
3. Review privileged access logs
4. Test segregation of duties conflicts

## Phase 3: Change Management Testing (CM)
1. Test change management controls
   - [ ] CM-1: Changes follow documented approval process
   - [ ] CM-2: Changes tested before production deployment
   - [ ] CM-3: Separation of development and production environments
   - [ ] CM-4: Emergency changes follow expedited approval process
   - [ ] CM-5: Developer access to production restricted
   - [ ] CM-6: Changes to databases and infrastructure follow process
   - [ ] CM-7: Version control and rollback procedures exist
2. Sample and test change records for proper approvals
3. Verify test evidence for sampled changes
4. Review emergency change documentation

## Phase 4: Computer Operations Testing (CO)
1. Test IT operations controls
   - [ ] CO-1: Batch jobs/scheduled tasks monitored for completion
   - [ ] CO-2: Job failures investigated and resolved timely
   - [ ] CO-3: Data backups performed per schedule
   - [ ] CO-4: Backup restoration tested periodically
   - [ ] CO-5: Incident management process followed
   - [ ] CO-6: System availability monitored against SLAs
   - [ ] CO-7: Physical/environmental controls adequate
2. Review batch job monitoring logs
3. Verify backup and restoration test evidence
4. Review incident records for operational issues

## Phase 5: Program Development Testing (PD)
1. Test program development controls
   - [ ] PD-1: SDLC methodology documented and followed
   - [ ] PD-2: Requirements documented and approved
   - [ ] PD-3: User acceptance testing performed
   - [ ] PD-4: Data migration validated for system implementations
   - [ ] PD-5: Post-implementation review completed
2. Sample and test new system implementations
3. Verify project documentation and approvals

### Control Testing Summary

| Category | Controls Tested | Effective | Deficiency | Material Weakness |
|----------|----------------|-----------|------------|-------------------|
| Access Controls (AC) | | | | |
| Change Management (CM) | | | | |
| Computer Operations (CO) | | | | |
| Program Development (PD) | | | | |
| **Total** | | | | |

## Phase 6: Deficiency Assessment & Reporting
1. Classify identified deficiencies
   - Control deficiency: control does not operate effectively
   - Significant deficiency: reasonable possibility of material misstatement not prevented
   - Material weakness: reasonable possibility of material misstatement not prevented or detected
2. Develop remediation recommendations
3. Prepare management response for each finding
4. Report to audit committee

## Counter-Rationalizations

| Shortcut | Counter | Why |
|----------|---------|-----|
| "We can skip some steps for this case" | Adapt the workflow steps, don't skip them | Skipped steps are where incidents and oversights originate |
| "The user seems to already know what to do" | Complete all workflow phases with the user | The workflow catches blind spots that experience alone misses |
| "This is a minor case, full process is overkill" | Scale the process down, don't turn it off | Minor cases become major when unstructured; the process scales, not disappears |
| "I'll fill in the details later" | Complete each section before moving on | Deferred details are forgotten; real-time capture is more accurate |
| "The template output isn't necessary" | Always produce the structured output format | Structured output enables comparison, audit trails, and handoff to other teams |

## Output Format
- **Scoping Document**: In-scope systems and control objectives
- **Test Work Papers**: Evidence and results per control
- **Deficiency Report**: Classified findings with root cause
- **Remediation Plan**: Corrective actions with owners and deadlines
- **Management Letter**: Summary of findings for leadership

## Action Items
- [ ] Finalize system scoping with external auditors
- [ ] Complete access control testing for all in-scope systems
- [ ] Test change management sample for the audit period
- [ ] Verify computer operations controls and evidence
- [ ] Classify all deficiencies found
- [ ] Develop remediation plans for each deficiency
- [ ] Present findings to audit committee