SOX and IT controls assurance

I’ve led SOX 404 and IT general controls audits and tested application controls in financial services. Much of the work is deciding whether the evidence answers the control question and what a gap means for the business process.

From the walkthrough to a test

I start with the process owner and walk through a recent transaction or change. For a production change, I trace who requested it, what was tested, who approved it and what reached production. I use that walkthrough to understand the design and record the risk, owner, frequency and evidence in the risk and control matrix. For an operating effectiveness conclusion I need evidence from the period under review.

I’ve worked with ServiceNow and Jira records and tested emergency changes, production migrations and SDLC controls. When approval follows deployment, I check whether the emergency procedure applies and what retrospective approval it requires.

Access, operations and application evidence

My access reviews have covered Active Directory, Entra ID, SailPoint and CyberArk. For a leaver, I compare the HR effective date with the disable event. For privileged access, I check how elevated rights are approved, how credentials are vaulted and what evidence exists for monitoring or periodic review. I’ve also tested controls around batch processing, incidents, backup and recovery.

I’ve tested maker-checker workflows, master data, input validation and interfaces in environments including Oracle ERP, SAP SuccessFactors and Axway SecureTransport. If the control relies on a system-generated report, I check its parameters, period and completeness before relying on it. For an interface, I’d reconcile records sent, received and rejected before drawing a conclusion from the exceptions.

Reporting a deficiency

I document what the control required, what the evidence showed and which parts of the process or reporting could be affected. I evaluate compensating controls before assigning severity. If a finding points to both an open account and a broken hand-off, I give the immediate removal and the process fix separate actions.

The leaver reconciliation project shows how I automated one of those checks. See what I owned in audit delivery and reporting.