Scrutineer · By framework

SOX compliance software for Section 404 controls, ITGC testing and evidence

SOX compliance lives or dies on evidence. Sarbanes-Oxley Section 404 asks you to show that internal control over financial reporting was designed well and actually operated, and the IT general controls behind your financial systems (access, change management and operations) are where most findings come from. The controls usually exist. Proving they ran, every quarter, without a manual scramble, is the hard part.

Scrutineer maps your ITGCs and process-level controls to the SOX control objectives you are testing, pulls the supporting evidence from your identity, cloud and ticketing systems, and tracks each test and remediation item to close. Control owners see what is due, gaps surface while there is still time to fix them, and your external auditor gets an organized, current evidence package instead of a folder of screenshots. Scrutineer is readiness and decision support: your independent registered public accounting firm audits ICFR and issues the opinion.

or try it below ↓

Control-mapped findings · linked evidence · you decide what to remediate

The Scrutiny Desk

Interactive walkthrough on a sample company, not a scan of your systems.

Worked example with sample findings, not a scrutiny of your environment. Not an audit attestation.

SOC 2 ISO 27001 HIPAA GDPR PCI DSS

Controls in evidence-linked report out

AI scrutinizes you decide

Why it works

What you get with SOX compliance

ITGCs mapped, not guessed

Access, change management and IT operations controls are mapped to the Section 404 objectives they support, so you can see coverage across every in-scope financial system rather than reconstructing it in a spreadsheet.

Evidence pulled every period

User access reviews, change approvals and job-failure logs are collected automatically as they happen, so quarterly testing draws on a continuous record instead of a backfill.

Deficiencies caught early

When a control misses a period or evidence goes stale, Scrutineer flags it and tracks remediation to close, so a control gap does not become a significant deficiency in the audit.

What it handles

Controls in, an evidence-linked report out

Point Scrutineer at a framework or a vendor and it maps every control, pulls the evidence it can find, flags the gaps and scores the risk, returning a report with linked evidence and a prioritized remediation list. Scrutineer is decision support for readiness, an accredited auditor still issues the attestation.

Maps ITGCs and process controls to Section 404 objectives
Collects access, change and operations evidence automatically
Tracks control testing by period with named owners
Flags missed control executions and stale evidence
Prioritizes remediation before the external audit
Produces an organized evidence package for your auditor

SOX compliance readiness_report

Readiness 82%

ACCESS CONTROL 91

evidence · MFA enforced and access reviews evidenced.

CHANGE MGMT 78

evidence · Mostly covered; one approval log left untested.

VENDOR RISK 64

evidence · Two subprocessors missing a current review.

ENCRYPTION 86

evidence · Data encrypted in transit and at rest, evidenced.

Every finding links to the evidence behind it

Why Scrutineer

One platform that maps controls and scores risk

Not a static questionnaire, not a pass-fail black box, and not a spreadsheet you maintain by hand. Live control mapping across SOC 2, ISO 27001, HIPAA, GDPR and PCI, automatic evidence and a prioritized gap list, returned as a report you can act on. The AI scrutinizes, you decide.

Mapped to real controls

Every framework is broken down into the controls it actually requires, each scored on a red to amber to green scale, so readiness stays transparent and consistent.

Evidence behind every finding

Each control links to the exact evidence that satisfies it, the policy, the config, the log line, so the finding is auditable and your readiness is defensible.

A prioritized gap list

Open gaps roll up into a ranked remediation list, so the highest-risk findings sit at the top and your team fixes what matters before the audit begins.

SOX 404 evidence reference

What a SOX 404 ITGC test actually asks for, and what teams hand over instead

Most SOX content lists the ITGC domains. Listing them is not the problem. The problem is that for each domain there is a specific piece of evidence that satisfies the test and a convenient substitute that does not, and the substitute is what gets uploaded. This table runs on that gap, because that is where the audit hours go.

ITGC area	What the auditor is actually testing	Evidence that holds up	What teams hand over instead	Why the substitute fails
Access provisioning	That every access grant was requested and approved before it was granted	The request record with approver, timestamp and the resulting account, sampled across the whole period	A current user list exported the week of the audit	A point-in-time list proves who has access today. It says nothing about whether anyone approved it when it was granted
Access removal	That access ended inside the stated window after a termination or a transfer	HR termination dates joined to account disable dates for the full population, not a sample of the tidy ones	A statement that offboarding is automated	Automation is a claim about control design. The auditor tests operating effectiveness, which means the dates
Privileged access and segregation of duties	That administrator rights are restricted and that no single person can both make and approve a change	The privileged account inventory with a business justification per account, the conflict rules, and any documented exceptions	The membership list of the domain administrators group	Membership is not justification, and the conflicts that actually matter usually live inside the application, not in the directory
Change management	That code and configuration reaching production was reviewed, approved and tested first	Pipeline records tying each deployment to an approved change with a named reviewer, including the emergency ones	The pull request template and the branch protection settings	Those are policy artifacts. The test is the population of deployments and the identification of the ones that skipped review
Job scheduling and batch processing	That failures in automated jobs feeding the financials are detected and resolved	Failure alerts with resolution records and evidence that the re-run reconciled	A screenshot of a green monitoring dashboard	A dashboard shows the current state. The test is what happened on the days it was red, and who noticed
Backup and recovery	That data supporting the financial statements can actually be restored	Restore test records with a date, a scope, a result and a named tester	The backup schedule and the retention policy	An untested backup is a plan, not a control. The evidence an auditor asks for is the restore, not the job
Information produced by the entity	Whether the report you used as evidence is itself accurate and complete	The query logic, the parameters, the source system, and a reconciliation of the report back to that source, kept with the report	The report	This is the failure that is not a control failure at all. Under PCAOB AS 1105 the auditor must test the accuracy and completeness of information produced by the company, and amendments to paragraph .10 plus a new paragraph .10A took effect for fiscal years beginning on or after December 15, 2025

The last row is where SOX programs quietly lose the most time, and it is the one nobody plans for. A control can operate perfectly and still fail testing because the report used to evidence it cannot be tied back to a source. Keep the query, the parameters and the reconciliation attached to the report itself rather than in one person memory, and the same evidence stops being re-derived every quarter.

Good questions

Questions about SOX compliance

SOX compliance software maps the internal controls over financial reporting required by Sarbanes-Oxley Section 404, collects the evidence that proves each control operated, and tracks testing and remediation. It replaces the spreadsheets and screenshot folders most teams use to prepare for the ICFR audit.

No tool can. Scrutineer keeps your controls mapped, your evidence current and your deficiencies tracked to close, which is what readiness means. Management still asserts on ICFR and an independent registered public accounting firm performs the audit. Scrutineer is not legal or accounting advice.

The three domains auditors focus on: logical access (provisioning, deprovisioning and periodic access reviews), change management (approvals, testing and segregation of duties in your deployment pipeline), and IT operations (backups, job monitoring and incident handling) for the systems in your financial reporting scope.

SOX 404 compliance means satisfying Section 404 of the Sarbanes-Oxley Act, which covers internal control over financial reporting. Section 404(a) requires management to assess ICFR effectiveness and report the conclusion in the annual report. Section 404(b) requires the company's independent PCAOB-registered auditor to attest to that assessment. In practice the work is documenting your controls, testing that they operated across the year, and evidencing both.

Who has to sign. 404(a) is management's own assessment of ICFR and applies to essentially every SEC reporting company. 404(b) adds an independent auditor attestation on top, and it only applies to accelerated and large accelerated filers. Non-accelerated filers were permanently exempted from 404(b) by the Dodd-Frank Act in 2010, and SEC amendments adopted March 12, 2020 pulled more low-revenue smaller reporting companies out of accelerated filer status as well. Emerging growth companies are generally exempt from 404(b) for up to five years after IPO. The distinction decides whether you are budgeting for an internal assessment or an external audit.

Accelerated filers, meaning a public float of $75 million to under $700 million, and large accelerated filers at $700 million or more. Below those thresholds a non-accelerated filer still owes the 404(a) management assessment but not the auditor attestation. Filer status is recalculated, so a company can cross into 404(b) after a good year, which is the moment thin control documentation becomes expensive. Confirm your own status with your counsel or auditor; the thresholds interact with smaller reporting company and emerging growth company rules.

They divide into entity-level controls, business process controls over significant accounts, and IT general controls over the systems those processes run on. The ITGC layer is where most software-driven companies concentrate: access to programs and data, change management, and computer operations. An ITGC failure is serious out of proportion to its size, because if change control is broken the auditor cannot rely on any automated control or report from that system.

SOX is a law that obliges a public company to assess its own internal control over financial reporting. SOC 1 is a voluntary examination a service organization commissions so that its customers can rely on its controls. They meet in the middle: when a public company outsources something that touches its numbers, the SOC 1 report from that provider becomes part of how the company supports its own SOX 404 assessment.

Not on its own, and this is a common misreading. A SOC 1 gives management and its auditors evidence about controls at one service organization for one period. Management still has to assess the controls it operates itself, confirm the report period covers its own year, obtain a bridge letter for any gap, and implement the complementary user entity controls the report assumes. A SOC 1 is an input to a SOX assessment, not a substitute for one.

Any third party performing a process that affects your financial statements: payroll processing, billing and receivables, claims administration, loan servicing, fund administration, benefit plan recordkeeping, and increasingly cloud platforms that calculate or hold financial data. If the provider could cause a misstatement in your books, its controls are in scope for your assessment and you should be collecting its SOC 1 annually.

Yes, and the overlap is larger than most teams assume. Logical access, change management and IT operations are the same IT general controls in all three programs, and they are usually the majority of the testing burden. What differs is the layer above: SOX adds process controls over financial reporting, SOC 1 adds control objectives you write yourself, and SOC 2 adds the Trust Services Criteria. One evidence base can serve all three.

The one that starts holding dated ITGC evidence before the year your auditor tests, because 404(b) is an opinion on operating effectiveness over a period and evidence cannot be backfilled. A newly public company gets a transition: no management report or auditor attestation until its second annual report, and an emerging growth company is exempt from 404(b) while it keeps EGC status. Use that window for a dry-run year. Pick workflow tooling sized to a two or three person SOX team and an evidence layer for access, change and operations controls; Scrutineer covers the evidence layer, your auditor still attests.

Testing is proving a control operated throughout the period, not that it exists today. Testers select a sample from the whole year and examine the artifact behind each item: the approval on a change ticket, the reviewer sign-off on an access review, the resolution of a failed job. Because it is period-based, evidence assembled in the weeks before fieldwork is the most common source of exceptions. Continuous collection is what makes a sample easy to satisfy.

IT general controls, or ITGCs, are the controls over the technology environment that financial applications depend on. In a SOX 404 audit they are usually grouped into access to programs and data, program change, program development, and computer operations. They matter because if the ITGCs fail, the automated controls inside the financial application cannot be relied on either.

ITGCs are controls over the environment: who gets access, how changes reach production, how jobs and backups are run. ITACs, IT application controls, are controls built into the application itself, such as a three way match, an edit check or an automated approval limit. The relationship is one directional. Weak ITGCs undermine every ITAC that runs on that system.

Information produced by the entity, often shortened to IPE, is any report or extract your own systems generated that you then use as audit evidence. Because the auditor did not produce it, PCAOB AS 1105 requires them to test whether it is accurate and complete, or test the controls over that accuracy and completeness. In practice that means keeping the query, parameters and a reconciliation with the report.

Access provisioning, access removal, periodic user access review, privileged access and segregation of duties, change management, program development, job scheduling and batch processing, and backup and recovery. Not every domain applies to every system. Scope is set by which applications and infrastructure actually support a financial reporting assertion.

Yes, but the testing splits. Controls the vendor operates, such as data center security and platform change management, are usually covered by their SOC 1 report, and you evaluate that report and its complementary user entity controls. Controls you operate inside the tenant, above all access provisioning, removal and privileged roles, remain yours to test and evidence.

Severity turns on whether the deficiency could allow a material misstatement to go undetected, not on how many exceptions were found. A single failed change control on a system that posts journal entries can be more severe than dozens of exceptions on a reporting-only system. Auditors also look at compensating controls and whether the deficiency was detected internally or by them.

Read every compliance and risk question

Keep reading

Guides that go deeper on SOX and IT general controls

SOX compliance requirements explained

Sections 302 and 404 in plain terms, what management has to assert, and where IT general controls fit.

Read the guide

The user access review process

The access to programs and data ITGC that fails most often, the evidence auditors sample, and the five exceptions they write up.

Read the guide

SOX compliance software compared

Eight SOX tools by origin, which SOX testing tool fits which job, and the 404 duties by filer status.

Read the guide

SOC 1 compliance checklist and what auditors test

The report your outsourced providers owe you, and the report you owe your customers if you are the service organization.

Read the guide

What compliance automation costs

How platforms in this category price, what drives the number up, and the line items buyers miss.

Read the guide

Explore more

More ways to scrutinize compliance and risk with Scrutineer

SOC 2 compliance

Map controls to the Trust Services Criteria, collect evidence, and close gaps before audit.

Learn more

SOC 2 compliance software

A platform that maps SOC 2 controls, automates evidence, and tracks readiness continuously.

Learn more

ISO 27001 compliance

Map your ISMS to Annex A, automate evidence, and stay certification-ready.

Learn more

See every use case See pricing Back to Scrutineer

Stop guessing about readiness. Scrutinize on real evidence.

Point Scrutineer at a framework or a vendor and it maps every control, gathers evidence and scores the risk, returning an evidence-linked report and a prioritized gap list. The AI scrutinizes, you decide.

See pricing

SOC 2, ISO 27001, HIPAA, GDPR & PCI · evidence-linked controls · readiness, not certification