Sarbanes-Oxley, and the controls privacy programmes inherit.
The Sarbanes-Oxley Act governs financial reporting, but its discipline, IT general controls, access governance and evidence, is the same discipline a strong privacy programme relies on.
Key points
Management certification of controls, and an assessment of internal control over financial reporting.
Access management, change control and operations, the backbone privacy audits also rely on.
Least privilege and segregation of duties that double as privacy safeguards.
Repeatable, documented evidence, the habit that makes ISO and privacy audits pass.
Passed after the Enron and WorldCom failures. Title I creates the PCAOB to oversee auditors of public companies.
SEC rules require management's annual report on internal control over financial reporting (ICFR) and name COSO as a suitable framework.
SEC management guidance and PCAOB AS 5 (now AS 2201) focus effort on the risks that could cause a material misstatement.
Section 989G permanently exempts non-accelerated filers from the auditor attestation in Section 404(b).
Emerging growth companies are exempt from 404(b) for up to five years after their IPO.
Smaller reporting companies with annual revenue under $100 million fall outside the accelerated filer definition, so they have no 404(b) attestation.
The sections a GRC team actually works with
SOX has eleven titles. These are the provisions that create day-to-day control, certification and evidence work.
| Section | What it requires | Typical owner | Evidence auditors expect |
|---|---|---|---|
| 101 to 105 | Creates the PCAOB, which registers, inspects and sets standards for audit firms of public companies. | External auditor | Audit performed under PCAOB standards, including AS 2201 for integrated audits. |
| 201 | Prohibits the auditor from providing certain non-audit services, such as financial systems design and internal audit outsourcing, to its audit client. | Audit committee | Pre-approval log of all auditor services; independence confirmations. |
| 301 | Independent audit committee, directly responsible for the auditor, with procedures for complaints about accounting and auditing matters, including confidential employee submissions. | Audit committee, Company Secretary | Charter, minutes, whistleblower channel records and case log. |
| 302 | CEO and CFO certify each quarterly and annual report: it is accurate, disclosure controls are designed and evaluated, and significant deficiencies and fraud are disclosed to the auditor and audit committee. | CEO, CFO, Disclosure Committee | Sub-certifications from process owners, disclosure committee minutes, deficiency summary. |
| 404(a) | Management's annual assessment of the effectiveness of ICFR, using a suitable framework such as COSO 2013. | CFO, SOX PMO, control owners | Scoping memo, risk and control matrix, walkthroughs, test results, deficiency evaluation, management report. |
| 404(b) | The external auditor attests to the effectiveness of ICFR, for accelerated and large accelerated filers. | External auditor | Integrated audit opinion; the auditor relies on the same evidence as 404(a). |
| 409 | Rapid disclosure of material changes in financial condition or operations. Implemented through Form 8-K, generally within four business days. | Legal, Investor Relations | Disclosure procedures, event triage log, 8-K filings. |
| 802 | Crime to destroy, alter or falsify records to obstruct an investigation (18 U.S.C. 1519), and audit workpaper retention (18 U.S.C. 1520). | Legal, Records management | Retention schedule, legal hold process, immutable storage for key records. |
| 806 | Protects employees who report suspected securities fraud from retaliation (18 U.S.C. 1514A). | HR, Legal | Whistleblower policy, anti-retaliation training, case handling records. |
| 906 | Criminal certification that periodic reports comply with the Exchange Act and fairly present the financial condition (18 U.S.C. 1350). | CEO, CFO | Signed certifications filed as exhibits to 10-K and 10-Q reports. |
| 1107 | Crime to retaliate against a person who gives truthful information about a federal offence to law enforcement. | HR, Legal | Same controls as Section 806, applied company-wide. |
302 or 404? Section 302 is a quarterly certification covering disclosure controls, and it applies to every SEC registrant. Section 404 is an annual, evidence-heavy assessment of ICFR. In practice one control set supports both: the 404 programme is the engine that lets executives sign 302 with confidence.
Who is covered, and by which sections
SOX applies to issuers registered with the SEC, including foreign private issuers listed in the United States. How far Section 404 reaches depends on your filer status.
| Category | Test (simplified) | 302 and 906 | 404(a) management | 404(b) auditor |
|---|---|---|---|---|
| Large accelerated filer | Public float of $700 million or more | Yes | Yes | Yes |
| Accelerated filer | Public float of $75 million to under $700 million, and not a smaller reporting company with revenue under $100 million | Yes | Yes | Yes |
| Non-accelerated filer | Public float under $75 million, or a smaller reporting company with annual revenue under $100 million | Yes | Yes | No |
| Emerging growth company | JOBS Act status, for up to five years after IPO | Yes | Yes | No |
| Newly public company | First annual report after IPO | Yes | Transition relief | Transition relief |
| Foreign private issuer | Files Form 20-F; the same float tests apply | Yes | Yes | If accelerated |
Private companies
Most of SOX does not apply, but Sections 802 and 1107 are criminal provisions that reach everyone. Lenders, acquirers and IPO plans often impose SOX-grade controls anyway.
Subsidiaries abroad
An Indian, European or APAC subsidiary of a US registrant is in scope when its processes or systems are material to the consolidated accounts. Local teams own controls and sub-certify.
Service organisations
Outsourced payroll, cloud ERP and shared service centres stay inside your ICFR. You rely on their SOC 1 Type II report and operate the complementary user entity controls.
COSO 2013: five components, seventeen principles
The SEC accepts COSO's Internal Control Integrated Framework as a suitable basis for the 404(a) assessment. Every principle must be present and functioning, and each maps to controls you can evidence.
Control environment
- Commitment to integrity and ethical values
- Board independence and oversight
- Structures, reporting lines and authority
- Commitment to competence
- Accountability for internal control
Risk assessment
- Objectives specified clearly
- Risks identified and analysed
- Fraud risk assessed
- Significant change identified and analysed
Control activities
- Control activities selected and developed
- General controls over technology
- Deployed through policies and procedures
Information and communication
- Relevant, quality information used
- Internal communication
- External communication
Monitoring activities
- Ongoing and separate evaluations
- Deficiencies evaluated and communicated
Principle 11 is where IT lives. General controls over technology are an explicit COSO principle. The ITGC library below is how you show Principle 11 is present and functioning for every in-scope application, database, operating system and cloud platform.
An ITGC library you can deploy
ITGCs give assurance that automated controls, system-generated reports and interfaces work consistently all year. Four domains, the controls auditors test most often, and where each one usually fails.
| Domain | Control | Frequency | Key evidence | Where it usually fails |
|---|---|---|---|---|
| Access to programs and data | New user access is requested, approved by the business owner and provisioned as approved | Per event | Ticket with approval before the provisioning date | Approval recorded after access was granted |
| Access to programs and data | Leavers are removed promptly (for example within one business day) | Per event | HR leaver report reconciled to disable timestamps | Contractors missing from the HR feed |
| Access to programs and data | Periodic user access review by business owners | Quarterly | Complete user listing (validated as IPE), sign-off and completed removals | Rubber-stamp reviews; incomplete population |
| Access to programs and data | Privileged and superuser access restricted and its activity monitored | Quarterly or monthly | Admin listing, log review evidence and follow-up | Shared or generic admin accounts |
| Access to programs and data | Authentication meets policy (MFA, password parameters, SSO) | Annual or on change | System configuration screenshots and IdP policy export | Local accounts bypassing SSO |
| Program changes | Changes are authorised, tested and approved before release to production | Per change | Change ticket with test evidence and CAB approval | Test evidence missing for minor changes |
| Program changes | Developers cannot migrate their own code to production | Continuous | Deployment role listing and pipeline permissions | DevOps engineers with both roles |
| Program changes | Emergency changes are approved retrospectively and reviewed | Per event | Emergency change log with post-implementation approval | Emergency path used as the norm |
| Program changes | Changes in production reconcile to approved tickets | Monthly or quarterly | System change log compared with the ticket register | Vendor-pushed SaaS updates not assessed |
| Program development | New systems and major upgrades follow an SDLC with data conversion validation | Per project | Requirements, UAT sign-off, conversion reconciliation, go-live approval | Conversion totals not reconciled |
| Computer operations | Batch jobs and interfaces are monitored and failures resolved | Daily | Job scheduler logs and incident tickets | Failures fixed with no ticket trail |
| Computer operations | Backups run and restores are tested | Daily backups, periodic restore tests | Backup reports and restore test records | Restores never tested |
| Computer operations | Incidents affecting financial systems are logged, analysed and resolved | Per event | Incident register with root cause analysis | Financial impact not assessed |
The annual lifecycle, end to end
A top-down, risk-based cycle in line with SEC management guidance and PCAOB AS 2201. Each step produces an artefact the next step and the auditor rely on.
Overall and performance materiality, significant accounts and disclosures, relevant assertions.
Locations by coverage, processes by account, and the applications, databases and platforms that support them.
What could go wrong, and the key controls that address it: entity-level, process-level, ITGC and automated.
Follow one transaction end to end, and confirm each control is designed to prevent or detect the risk.
Sample by frequency and risk, validate IPE, and retain evidence that another reviewer could re-perform.
Assess severity individually and in aggregate, and consider compensating controls.
Fix design or operation, then allow enough operating time before year end to retest.
Sub-certifications, management's report, and audit committee communication. Then feed lessons into next year.
Control deficiency
A control that does not allow management or employees, in the normal course of their work, to prevent or detect misstatements on a timely basis.
Significant deficiency
Less severe than a material weakness, yet important enough to merit the attention of those responsible for overseeing financial reporting.
Material weakness
A reasonable possibility that a material misstatement will not be prevented or detected on a timely basis. It must be disclosed, and ICFR cannot be concluded effective.
Five working tools for scoping, testing and reporting
Built on SEC filer rules, PCAOB AS 2201 concepts and common audit practice. Everything runs in your browser and nothing is sent anywhere. Results are indicative; your auditor's methodology and legal counsel prevail.
Enter your public float and revenue to see your filer category and which sections apply.
Rate each control as it operates today. 0 = not in place, 1 = informal, 2 = documented and operating, 3 = tested with retained evidence.
Tick every duty one person (or one role) can perform in your systems. Conflicting combinations appear below with the risk each creates.
Indicative guidance only, not legal or audit advice. Sample sizes reflect commonly used practice; your external auditor's methodology prevails.
SOC 1 reports, IPE, spreadsheets and segregation of duties
The four topics behind most ITGC findings. Get them right and the rest of the programme becomes routine.
SOC 1 Type II and CUECs
For outsourced processes, obtain a SOC 1 Type II report (SSAE 18, or ISAE 3402 outside the US) that covers most of your fiscal year. Check the opinion, exceptions and subservice carve-outs, get a bridge letter for any gap to year end, and map every complementary user entity control (CUEC) to a control you actually operate.
Information produced by the entity (IPE)
Every report a control relies on, such as user listings, ageing reports or exception reports, needs evidence that it is complete and accurate: parameters, source-to-report reconciliation, and control over report logic through ITGCs.
End-user computing
Key spreadsheets that calculate reserves, allocations or journal entries need an inventory, access protection, version control, logic review and input reconciliation, or they become a weak link in ICFR.
Segregation of duties
Define a ruleset of incompatible duties, test it against the roles actually assigned in your ERP, remove conflicts where you can, and put detective controls on the rest. Use the SoD conflict tool above to start the ruleset.
Penalties and personal accountability
SOX made executives personally accountable for the accuracy of what they sign. The criminal ceilings are set out in the statute.
Section 304 requires the CEO and CFO to repay bonuses and trading profits after a restatement caused by misconduct. SEC Rule 10D-1 now requires listed companies to recover erroneously awarded incentive pay after any accounting restatement.
The SEC can seek to bar individuals from serving as officers or directors of public companies.
A disclosed material weakness brings auditor scrutiny, higher audit fees, remediation cost and investor attention, often well beyond any direct penalty.
SOX controls mapped to ISO 27001 and privacy law
The same evidence can satisfy your auditor, your certification body and a data protection regulator. This is where a SOX programme repays itself.
| SOX control area | ISO/IEC 27001:2022 Annex A | Privacy outcome (GDPR and DPDP Act) |
|---|---|---|
| User provisioning and access reviews | 5.15 Access control, 5.18 Access rights, 8.2 Privileged access rights | Security of processing (GDPR Art. 32); reasonable security safeguards (DPDP S. 8(5)) |
| Segregation of duties | 5.3 Segregation of duties | Limits insider misuse of personal data; supports accountability |
| Change management | 8.32 Change management | Integrity of processing; privacy by design for changes to personal data flows (GDPR Art. 25) |
| Program development and SDLC | 8.25 Secure development life cycle, 8.33 Test information | Data protection by design and by default; no production personal data in test without safeguards |
| Operations, logging and monitoring | 8.13 Backup, 8.15 Logging, 8.16 Monitoring activities | Breach detection and log retention (DPDP Rules 6 and 7); availability and resilience |
| Incident management | 5.24 to 5.28 Incident management | 72-hour notification (GDPR Art. 33); breach intimation to the Board and affected Data Principals (DPDP) |
| Service organisations and SOC 1 | 5.19 to 5.22 Supplier relationships | Processor contracts and oversight (GDPR Art. 28; DPDP S. 8(2)) |
| Record retention (S. 802) | 5.33 Protection of records | Storage limitation: document SOX retention as a legal obligation in your retention schedule, then erase on expiry |
| Whistleblower channels (S. 301, 806) | 6.8 Information security event reporting | Hotline data is sensitive: limit access, set retention and assess the channel with a DPIA |
A 90-day plan to a defensible first cycle
For a first-year SOX programme, a pre-IPO readiness project or a reset after findings. Each phase ends in artefacts that an auditor can use.
Scope and risk
- Materiality, significant accounts and assertions
- In-scope entities, processes and applications
- Entity-level control inventory
- SOC report inventory and gap list
- Owner map and governance calendar
Deliverable: scoping memo approved by the CFO
Document and design
- Process narratives and flowcharts
- Risk and control matrix with ITGC mapping
- IPE and key spreadsheet inventory
- SoD ruleset and conflict analysis
- Walkthroughs and design gaps
Deliverable: RCM and design assessment
Test and remediate
- Operating effectiveness testing by frequency
- Deficiency log and severity evaluation
- Remediation plans with owners and dates
- Sub-certification process for 302
- Dry run of management's 404 report
Deliverable: audit committee readiness pack
SOX, answered plainly
Is SOX a privacy law?
No. SOX governs the reliability of financial reporting. However, its access, change, operations and evidence controls are the same controls a privacy regulator expects when it asks whether personal data is protected by reasonable security safeguards.
Does SOX apply to private companies?
Most provisions apply only to SEC registrants. Sections 802 (record destruction) and 1107 (retaliation against informants) are criminal provisions that apply to anyone. Private companies planning an IPO, or subject to lender or acquirer requirements, often adopt SOX-grade controls early.
What is the difference between Section 302 and Section 404?
Section 302 requires the CEO and CFO to certify each quarterly and annual report, including their responsibility for disclosure controls. Section 404 requires an annual management assessment of internal control over financial reporting, and for accelerated filers an auditor attestation.
Which IT systems are in scope?
Systems that initiate, process, record or report transactions for significant accounts, or that produce reports used in key controls. That usually means the ERP, consolidation and reporting tools, key sub-ledgers, their databases and operating systems, and the identity platform that controls access to them.
What makes a deficiency a material weakness?
A reasonable possibility that a material misstatement will not be prevented or detected on a timely basis. Indicators include fraud by senior management, restating previously issued statements to correct a material error, and ineffective audit committee oversight.
Can we rely on our cloud provider's SOC 1 report?
Yes, if it is a Type II report covering the relevant controls and a suitable period, with any gap covered by a bridge letter. You must also operate the complementary user entity controls it lists, and assess any subservice organisations it carves out.
How long must records be kept?
SEC rules under Section 802 require auditors to retain audit workpapers for seven years. Companies set their own retention through a schedule that reflects SOX, tax and other legal obligations, and should apply legal holds whenever an investigation is anticipated.
How does a SOX programme help with the DPDP Act or GDPR?
Access reviews, change control, logging, incident response and vendor oversight are already evidenced for SOX. Mapped once, they support GDPR Article 32 and the DPDP Act's reasonable security safeguards, so privacy teams can focus on what SOX does not cover, such as notice, consent and data principal rights.
How long does a first SOX programme take?
Plan on about 90 days to reach a defensible first cycle: scoping and risk assessment, a documented control set with owners, a walkthrough of each key control, and the first round of operating-effectiveness testing. Our 90-day plan sets out the steps week by week.
Do ITGCs apply to cloud and SaaS applications?
Yes, if the application supports financial reporting. Obtain the provider’s SOC 1 Type II report, operate the complementary user entity controls it lists, and keep testing the controls you still own, such as user access, configuration changes and interfaces.
Read the originals
Management's report on ICFR (2003), management guidance (2007) and accelerated filer amendments (2020). sec.gov
This guide is general information, not legal or audit advice. Last reviewed 9 October 2026.
From applicability to evidence
We map your processing to this regime, build the controls behind the obligations, and prepare the evidence that proves compliance.