SOX ITGC
IT general controls — access, change management, and operations — for the technology half of a SOX programme.
What SOX ITGC is
Sarbanes-Oxley Section 404 requires management to assess and report on the effectiveness of internal control over financial reporting, and requires the external auditor to attest to that assessment under PCAOB Auditing Standard 2201. Neither SOX nor the PCAOB publishes a control catalogue, which surprises people coming from ISO or NIST: there is no official list to implement.
What exists instead is convention. Nearly every SOX programme expresses the IT layer — the general controls that make application and business-process controls relyable — using COSO's 2013 Internal Control framework, operationalised into four canonical domains: access management, change management, computer operations, and program development. Every major advisory methodology uses some version of those four.
ITGCs matter disproportionately because of how audit reliance works. If ITGCs are found ineffective, the automated application controls that depend on them cannot be relied upon either, and the audit falls back to substantive testing across the whole financially relevant estate. A single ineffective access-review control can therefore cost far more than its own remediation.
Who it applies to
- US public companies and their subsidiaries subject to Section 404.
- Companies preparing for an IPO, where ITGC readiness is a standard diligence item and usually the least ready one.
- Private companies with debt covenants or investor requirements that reference SOX-equivalent controls.
- IT functions supporting a controllership or internal audit team that owns the wider ICFR programme.
How it is structured in CMDash
CMDash seeds representative ITGC control statements across the four canonical domains, worded to mirror the boilerplate found in typical SOX ITGC control matrices so that auditors and controllers recognise the language on sight. Because SOX publishes no catalogue, this is a defensible standard set rather than an authoritative one, and tenants are expected to tailor ownership, frequency and system names to their own environment.
| Access Management | 13 |
| Change Management | 13 |
| Computer Operations | 13 |
| Program Development / SDLC | 13 |
These counts are the control rows CMDash actually seeds, checked against the seed files by a test on every build.
The control text
Controls carry their identifier, title, and CMDash’s own evidence-requirement guidance. No verbatim source text is bundled for this framework. If you hold the official document, you can load its text through the framework CSV import.
What CMDash does for SOX ITGC
- The four ITGC domains tracked as controls with owners, statuses, evidence requirements and dated evidence — which is most of what an ITGC walkthrough asks for.
- A read-only, time-boxed seat for external audit scoped to this framework, with access recorded. Given how much of SOX testing runs through screenshots emailed to auditors, that alone changes the workflow.
- Policies authored in CMDash link to the ITGC controls they govern, so the control matrix shows the policy behind each control rather than referencing a document nobody can find.
- Gap export in POA&M form for remediation tracking through to the next testing cycle.
- Every control is a tracked row with an owner, a status (not started, in progress, implemented, not applicable, at risk, failing), reviewer notes, and its own evidence requirements — not a checkbox on a spreadsheet.
- Evidence is uploaded against a specific control, dated, and kept on that control, so an assessor can see what was true when.
- Gaps export to a POA&M CSV — every control that is not implemented and not marked out of scope, with owner, status and evidence requirements.
- Policies you author in CMDash link to the controls they govern, so each control row shows which living policies stand behind it.
- A time-boxed, read-only external assessor seat can be scoped to just this framework, with an expiry date you set and a record of every page they opened.
What it shares with your other frameworks
No crosswalk mappings ship for SOX ITGC. Evidence you collect against it does not automatically surface on your other frameworks, and that is worth knowing before you plan the work.
Where the evidence comes from
CMDash reads from the security tools you already run and turns what they report into control evidence. These are the integrations whose data lands closest to SOX ITGC’s control groups — you decide which control each signal evidences, and CMDash keeps it current from then on.
Where CMDash stops
Published on purpose. A buyer who discovers a limit after signing is a support ticket and a refund conversation; a buyer who reads it here is making an informed decision.
- This is a representative control set, not an authoritative one, because no authoritative one exists. Your external auditor's methodology decides your control matrix, and CMDash's job is to hold it, not to define it.
- No crosswalk mappings to other frameworks are seeded for SOX ITGC. It is the one framework in the catalogue that currently stands alone, so evidence collected here does not automatically surface against your security frameworks.
- Business-process and application-level controls — the other and larger half of an ICFR programme — are out of scope entirely. This is the IT general controls layer only.
- CMDash is not an auditor and produces no opinion on control effectiveness.
Common questions
Why does CMDash not have "the" SOX control list?
Because there isn’t one. SOX Section 404 requires an assessment of internal control over financial reporting; PCAOB AS 2201 governs how auditors test it. Neither publishes a control catalogue. Any vendor presenting an official SOX control set has invented it — CMDash ships a standard set and says plainly that it is a starting point your auditor will shape.
Does this cover the whole SOX programme?
No — the IT general controls layer only. Business-process controls, entity-level controls and application controls are the larger part of an ICFR programme and are owned by finance, not IT.
Does SOX work count towards our security frameworks?
Substantively, often yes — access reviews and change management are ITGC controls and SOC 2 criteria both. Mechanically, no: SOX ITGC has no seeded crosswalks in CMDash, so that overlap is not automatic and it would be dishonest to imply it is.
Also in Audit & Attestation
Paid plans cap how many frameworks you run at once, never which ones — SOX ITGC is available on every paid plan.
View pricingReady to see your posture?
Start a 30-day free trial of any paid plan — a card is required, and it converts unless you cancel — or sign up for Free with no card at all.