SOX IT General Controls (ITGC) Compliance Checklist

Implement user authentication, authorization, and access provisioning/deprovisioning processes for all financial systems. Ensure user access rights align with job responsibilities and are reviewed quarterly.

Restrict physical access to data centers, server rooms, and facilities housing financial systems through badge systems, biometric controls, and visitor logs. Maintain access logs for audit trails.

Establish formal procedures for system changes, including change request documentation, testing requirements, approval workflows, and segregation between development and production environments.

Separate incompatible functions to prevent single individuals from having end-to-end control over critical financial processes. Document and remediate SOD conflicts with compensating controls where separation is not feasible.

Maintain comprehensive documentation of IT policies, procedures, system architectures, and control activities supporting financial reporting. Update documentation annually or when material changes occur.

Establish automated backup procedures for financial data with defined recovery time objectives (RTO) and recovery point objectives (RPO). Test restoration procedures at least quarterly.

Perform quarterly user access reviews for all financial systems, removing unnecessary privileges and terminated user accounts. Document review results and remediation actions.

Implement database access restrictions, encryption for sensitive financial data, database activity monitoring, and privileged user access logging for all databases supporting financial reporting.

Deploy firewalls, intrusion detection systems, network segmentation, and encrypted communications for financial systems. Conduct annual penetration testing and vulnerability assessments.

Configure application-level security settings, role-based access control (RBAC), and transaction authorization limits within financial applications. Disable default and shared accounts.

Implement system development lifecycle (SDLC) controls including requirements documentation, code reviews, testing protocols, and migration procedures from development through production.

Establish procedures for job scheduling, batch processing monitoring, error logging, incident response, and problem management for systems supporting financial reporting.

Enable comprehensive audit trails for all financial system activities, including user actions, administrative changes, and data modifications. Retain logs for minimum seven years and monitor for anomalies.

Define IT governance structure with clear roles, responsibilities, and accountability for IT controls affecting financial reporting. Establish IT steering committee with executive oversight.

Perform annual testing of IT general controls using appropriate sampling methodologies. Document test procedures, results, exceptions, and remediation plans for management and auditors.

Restrict and monitor privileged access (root, administrator, database admin) through separate accounts, enhanced logging, and approval workflows. Prohibit shared privileged accounts.

Assess IT controls at service organizations supporting financial reporting systems. Obtain SOC 1 Type II reports annually and evaluate complementary user entity controls (CUECs).