SOX IT Controls Guide (2026): Section 404, ITGCs and the ICFR Audit

Who it applies to

• Issuers that file annual reports under Sections 13(a) or 15(d) of the Exchange Act. These companies must include a management ICFR report under 404(a) (Public Law 107-204). The SEC's implementing rules were adopted in Release 33-8238 in June 2003 (SEC).
• Accelerated and large accelerated filers, which also need auditor attestation under 404(b).
• Since the 2020 amendments, smaller reporting companies with less than $100 million in revenue are not accelerated filers. They "will no longer be required to obtain a separate attestation of their ICFR from an outside auditor."
• They must still maintain ICFR, and their officers must still certify (SEC).
• Emerging growth companies have an exemption for up to five years after their IPO (SEC).
• Registered investment companies, which are exempt from Section 404 under Section 405 (Public Law 107-204).
• Service providers, such as cloud, payroll and payment processors, which are affected indirectly. Their clients' auditors rely on SOC 1-type service auditor reports that include tests of operating effectiveness. AS 2201 states that a report without tests of controls "does not provide evidence of operating effectiveness" (PCAOB).

Key requirements

Statutory core

• Section 302: the CEO and CFO certify every annual and quarterly report. They confirm that they are responsible for internal controls, have evaluated them, and have disclosed significant deficiencies to the auditors and audit committee (Public Law 107-204).
• Section 404(a): management states its responsibility for ICFR and assesses its effectiveness as of fiscal year-end.
• Section 404(b): the auditor attests to and reports on that assessment (Public Law 107-204).
• Section 906: the CEO and CFO certify that periodic reports comply and fairly present the company's financial condition, with criminal penalties for false certification (see Penalties).

Using a framework

Management must assess ICFR against a "suitable control framework." The SEC named COSO's Internal Control—Integrated Framework as an example (SEC Release 33-8810). The auditor must use the same framework that management uses (PCAOB).

Where IT fits

AS 2201 requires the auditor to understand "how IT affects the company's flow of transactions." It states that identifying IT risks and controls "is not a separate evaluation" but part of the top-down approach (PCAOB).

The standard also allows benchmarking of automated application controls. An auditor can rely on prior testing only if "general controls over program changes, access to programs, and computer operations are effective and continue to be tested" (PCAOB).

In practice, ITGC programs cover:

• Logical access: provisioning, removing access, privileged access and periodic reviews.
• Program change management: authorization, testing, approval, and segregation between development and production.
• Computer operations: job scheduling, backups and incident handling.
• Program development: acquiring or implementing systems that affect financial data.

These programs also address interfaces and data completeness, report logic, and segregation of duties within ERP roles. AS 2201 notes that smaller companies may compensate for limited segregation with alternative controls (PCAOB).

Deficiency levels

• A material weakness is a deficiency, or combination of deficiencies, that creates "a reasonable possibility that a material misstatement… will not be prevented or detected on a timely basis."
• A significant deficiency is less severe, but important enough to merit the attention of those overseeing financial reporting.
• If a material weakness exists, ICFR cannot be considered effective and the auditor must issue an adverse opinion (PCAOB).

Certification process and timeline

SOX has no certification. It runs as an annual cycle:

1. Scope. Take a top-down approach from the financial statements to the significant accounts, relevant assertions and supporting systems.
2. Document controls. Cover entity-level controls, process controls, and the ITGCs over in-scope applications, databases, operating systems and service organizations.
3. Test. Management tests design and operating effectiveness. The guidance does not require management to "identify every control in a process" (SEC Release 33-8810).
4. Audit. The auditor performs walkthroughs, tests controls closer to the as-of date, and runs roll-forward procedures. The auditor may use the work of competent, objective internal staff (PCAOB).
5. Report. File the management report and the auditor's opinion in the 10-K, along with the quarterly 302 certifications.

Penalties

• Section 906: knowingly certifying a non-compliant report carries fines of up to $1,000,000 and/or 10 years' imprisonment. Doing so willfully carries up to $5,000,000 and/or 20 years (Public Law 107-204).
• Material weaknesses: these must be disclosed publicly, including their nature and impact and any remediation plans (SEC Release 33-8810).

Mapping to related frameworks

• COSO Internal Control—Integrated Framework: the usual SOX framework.
• SOC 1 reports: provide evidence about controls at service organizations.
• ISO 27001 and SOC 2: their access and change controls often overlap with ITGCs. However, auditors test against financial reporting assertions, not security objectives.
• NIST CSF: useful for wider cyber governance, but not a substitute for ICFR testing.

Readiness checklist

1. Map each significant account to the systems, reports and interfaces behind it.
2. Define your in-scope applications and infrastructure layers.
3. Document ITGCs for access, change and operations on every in-scope system.
4. Run quarterly user access reviews, with evidence retained.
5. Enforce change tickets with approval and testing, and separate developers from production.
6. Inventory your key reports and automated controls, and baseline them for benchmarking.
7. Collect SOC 1 Type 2 reports from your service providers and map their complementary user entity controls.
8. Test your controls before year-end so you have time to fix them.
9. Hold an evaluation process for deficiencies with your audit committee.

Common pitfalls

• Treating ITGCs as a standalone IT project rather than linking them to financial assertions.
• Accepting SOC reports without testing. Check coverage periods and complementary controls.
• Leaving privileged access unreviewed, or relying on shared admin accounts.
• Treating emergency changes as an afterthought. They often bypass approvals.
• Relying on inquiry alone. AS 2201 states that "inquiry alone does not provide sufficient evidence."

How AssureCore helps

• The Controls Register documents your ITGCs and owners.
• Evidence Management, with control linking and expiry alerts, keeps access reviews current.
• The Risk Register tracks financial reporting risks.
• Audit Reports (PDF or CSV) package your evidence for auditors.

Frequently asked questions

Official references

• Sarbanes-Oxley Act of 2002, Public Law 107-204 (GovInfo)
• SEC Release 33-8238 – Management's report on ICFR
• SEC Release 33-8810 – Interpretive guidance for management (2007)
• PCAOB – AS 2201 Audit of ICFR
• SEC press release 2020-58 – Accelerated filer amendments

Related frameworks

• PCI DSS guide
• ICIF guide
• DORA guide
• MAS TRM guide