Assess and strengthen IT governance, IT general controls and SOX readiness. Connect the relevant applications, risks, control owners and evidence to a repeatable assurance process.
Policies can be documented while access changes, production releases and operational exceptions remain difficult to evidence. A useful assessment follows how the control is designed, performed, reviewed and retained.
Access to process owners, relevant system records, prior findings and evidence for the agreed period.
Agree the scope, dependencies and responsibilities before work begins. Each workstream produces a defined output.
Map the systems, infrastructure, interfaces and third parties relevant to the agreed objectives. For SOX work, connect scope to financial reporting risk with finance and the audit stakeholders.
Review access administration, privileged access, change management and IT operations. Walk through the controls, agree test procedures and examine representative evidence.
Prioritise observations by risk and cause. Define remediation, interim measures, accountable owners and the evidence needed for retesting.
Define policy ownership, control calendars, evidence retention and issue escalation. Prepare management reporting and support audit requests within the agreed scope.
An indicative delivery route. Sequencing and timing follow the scope, dependencies and business readiness. The stages below define the evidence needed to proceed.
| Stage | Practical work | Decision gate | Accountable roles |
|---|---|---|---|
| 01Scope | Confirm systems, risks and assessment period. | Scope agreed | IT + Finance |
| 02Assess | Walk through controls and review evidence. | Findings reviewed | Control owners |
| 03Remediate | Implement agreed control improvements. | Actions evidenced | IT owners |
| 04Retest | Check the remediated control and evidence. | Results reviewed | Assessment lead |
| 05Sustain | Maintain calendars, evidence and issue reporting. | Owners accept | IT governance |
Confirm the roles and authority at the start. Record important decisions, control evidence and the route for unresolved risks.
Explore the core governance pillarOriginal mockups, built to show the structure and level of detail. All records, roles and statuses are illustrative; these are not client results or live product screens.
Finance system scope / access, change and operations
The stages, decisions, owners and evidence connecting the recommendation to delivery.
The final pack reflects the agreed scope, with decisions, limitations, owners and next actions documented.
Establish the baseline and agree the measures before assessing improvement. These examples are discussion points, not promised results.
Relevant systems and controls with named owners and an evidence requirement.
Completeness, review traceability and availability for the agreed period.
Open actions, retest outcomes and recurring exceptions.
Access to process owners, relevant system records, prior findings and evidence for the agreed period.
Discuss this prioritySOX scope is tailored to the entity and its financial reporting risks. Advisory and readiness work is separate from a statutory audit opinion.
Methodology reference: PCAOB AS 2201. Relevant primary guidance for the agreed assessment scope.
Start with the business priority, the constraints you face and the decisions worth addressing together.
Discuss your priorities
