https://eauditor.app/
SOX Compliance IT Checklist
Section 1: Q1 - Internal Controls
1. 1. Has the organization conducted an organizational risk assessment and made updates to reflect changes in its risk profile and tolerance?
Yes
No
N/A
2. 2. Have internal control owners and champions been identified?
Yes
No
N/A
3. 3. Have any new technologies used to manage the business been identified?
Yes
No
N/A
4. 4. Have in-scope processes and high-risk areas been identified?
Yes
No
N/A
5. 5. Have control owners been educated on minimum expectations, consistency, etc.?
Yes
No
N/A
Section 2: Q2 - Internal Controls
1. 1. Have IT systems been assessed, and have controls been ensured to maintain a reliable IT environment supporting financial reporting requirements?
Yes
No
N/A
2. 2. Have processes and internal controls been documented and communicated to others in the organization?
Yes
No
N/A
3. 3. Has the organization understood ineffective controls discovered in the risk assessment and updated or created controls as necessary?
Yes
No
N/A
4. 4. Has buy-in from management been obtained to reduce the risk of controls being overridden?
Yes
No
N/A
5. 5. Have temporary and permanent changes in the control environment resulting from changes to operating conditions been identified?
Yes
No
N/A
6. 6. Has the consistent design of internal controls been validated, deficiencies identified, and the root cause of those deficiencies isolated?
Yes
No
N/A
7. 7. Have monitoring and evaluation techniques been deployed to assess where things may have gone wrong?
Yes
No
N/A
Section 3: Q3 - Internal Controls
1. 1. Have team members and subject-matter experts worked together to develop meaningful, actionable risk management practices?
Yes
No
N/A
2. 2. Have deficiencies identified as a result of recent monitoring activities been remediated?
Yes
No
N/A
3. 3. Have risk management practices been deployed in a clear, deliberate fashion so the organization can work toward a common goal: better risk management?
Yes
No
N/A
4. 4. Have updated control practices been applied to ensure the reliability of information coming from IT systems, along with clearly documented procedures to validate the system output reliability?
Yes
No
N/A
5. 5. Have periods of time where internal controls may not have been effective been identified, noting the starting period where newly implemented and corrected controls are in place, and ensuring all involved have a clear understanding of the requirements to maintain effectiveness?
Yes
No
N/A
6. 6. Have controls been ensured to be designed to do what they’re supposed to do and that they’re functioning properly?
Yes
No
N/A
Section 4: Q4 - Internal Controls
1. 1. Have disclosure controls and procedures been updated for material information related to market, credit, and liquidity risks?
Yes
No
N/A
2. 2. Have all internal control activities been verified for effectiveness?
Yes
No
N/A
3. 3. Has the focus shifted to controls ensuring financial information presentation and disclosure is complete, accurate, and fairly presented in accordance with U.S. GAAP?
Yes
No
N/A
4. 4. If necessary, have subject-matter experts and advisors been consulted on the final application of business environment changes and how those should appear in financial reports?
Yes
No
N/A