<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-sox-it-controls-audit
description: >-
  Audit SOX IT General Controls (ITGCs) including change management,
  logical access, computer operations, and program development. Automate
  evidence collection for COSO framework alignment and PCAOB testing
  requirements across financial reporting systems.
domain: cybersecurity
subdomain: compliance-audit
tags:
  - sox
  - itgc
  - coso
  - pcaob
  - change-management
  - financial-reporting
  - compliance
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Performing SOX IT Controls Audit

## Overview

Sarbanes-Oxley (SOX) Section 404 requires management assessment and external
audit of internal controls over financial reporting (ICFR). IT General Controls
(ITGCs) underpin application controls and cover four domains: logical access,
change management, computer operations, and program development. This skill
automates evidence collection for ITGC testing aligned with COSO 2013 and
PCAOB AS 2201 standards.

Mode: `[MODE: BLUE]` — Internal control testing with evidence automation.

## Prerequisites

| Requirement | Install |
|---|---|
| Python 3.10+ | For agent tooling |
| Git CLI | Change management evidence |
| jq | `apt install jq` |
| AWS CLI | Cloud access review |

## Key Concepts

### ITGC Domains

```
SOX IT General Controls:
├── Logical Access Controls
│   ├── User provisioning / deprovisioning
│   ├── Periodic access reviews
│   ├── Privileged access management
│   ├── Password policy enforcement
│   └── Segregation of duties (SoD)
├── Change Management
│   ├── Change request documentation
│   ├── Testing and approval workflows
│   ├── Segregation of development and production
│   ├── Emergency change procedures
│   └── Release management controls
├── Computer Operations
│   ├── Job scheduling and monitoring
│   ├── Backup and recovery procedures
│   ├── Incident management process
│   ├── Batch processing controls
│   └── System availability monitoring
└── Program Development
    ├── SDLC methodology
    ├── Requirements documentation
    ├── Code review and testing
    ├── Security testing integration
    └── Go-live approval process
```

### COSO 2013 IT Mapping

| COSO Principle | ITGC Domain | Test Procedure |
|---|---|---|
| Principle 11 — Technology controls | Logical Access | Access review, PAM audit |
| Principle 11 — Technology controls | Change Management | Change ticket sampling |
| Principle 12 — Deployment policies | Program Development | SDLC evidence review |
| Principle 13 — Quality information | Computer Operations | Backup/recovery testing |

### Access Review Automation

```bash
# Extract active users from IAM
aws iam list-users --query 'Users[?PasswordLastUsed!=`null`].[UserName,PasswordLastUsed]' \
  --output table

# Find users with no MFA
aws iam get-credential-report --output text --query 'Content' | \
  base64 -d | awk -F, '$4=="true" && $8=="false" {print $1}'

# Check for inactive accounts (90+ days)
aws iam get-credential-report --output text --query 'Content' | \
  base64 -d | awk -F, 'NR>1 {print $1, $5}'

# Local user access review
awk -F: '$7 !~ /nologin|false/ {print $1, $3, $7}' /etc/passwd

# Verify privileged group membership
getent group sudo wheel adm root | awk -F: '{print $1": "$4}'

# SoD validation — developers should not have prod access
comm -12 <(getent group developers | tr ',' '\n' | sort) \
         <(getent group prod-access | tr ',' '\n' | sort)
```

### Change Management Evidence

```bash
# Git commit history for change evidence (past quarter)
git log --since="3 months ago" --format="%H|%an|%ad|%s" --date=short

# Count PRs with required approvals
gh pr list --state merged --limit 100 --json number,reviews \
  --jq '[.[] | select(.reviews | length > 0)] | length'

# Verify branch protection rules
gh api repos/{owner}/{repo}/branches/main/protection \
  --jq '{required_reviews: .required_pull_request_reviews.required_approving_review_count,
         status_checks: .required_status_checks.strict}'

# Check deployment approval gates
gh run list --workflow deploy.yml --limit 20 --json conclusion,event \
  --jq '[.[] | select(.conclusion=="success")] | length'
```

## Workflow

### Step 1: Scope Financial Reporting Systems

```bash
node scripts/agent.js --action scope --systems "ERP,GL,Billing" \
  --output /tmp/sox-scope.json
```

### Step 2: Test ITGC Controls

```bash
node scripts/agent.js --action test --domains access,change,operations \
  --period Q1-2026 --output /tmp/sox-test.json
```

### Step 3: Generate Audit Workpapers

```bash
node scripts/agent.js --action report --input /tmp/sox-test.json \
  --format workpaper --output /tmp/sox-workpapers.json
```

## Verification

- [ ] All in-scope financial systems identified and documented
- [ ] Logical access reviews completed for each system
- [ ] Change management samples tested with approval evidence
- [ ] Backup restoration tested with documented results
- [ ] Segregation of duties validated — no developers with prod access
- [ ] PCAOB testing requirements met (25+ sample size for high-volume controls)

## References

- [SOX Section 404](https://www.sec.gov/about/laws/soa2002.pdf)
- [COSO Internal Control Framework](https://www.coso.org/)
- [PCAOB AS 2201](https://pcaobus.org/oversight/standards/auditing-standards)
- [ISACA ITGC Guidance](https://www.isaca.org/)
