Annex
SOX IT General Controls Annex
This annex describes how organizations subject to the Sarbanes-Oxley Act (SOX) sections 302 and 404, or equivalent financial-reporting integrity regimes elsewhere (J-SOX in Japan, C-SOX in Canada, equivalents), can use the core GRC library to demonstrate IT General Controls (ITGC) supporting Internal Control over Financial Reporting (ICFR). The annex maps the library to the four ITGC domains, identifies the auditor expectations, and lists the artefacts that adopting entities must produce alongside the library to evidence operating effectiveness.
- Type
- Annex
- Version
- 0.0.6
- Date
- 2026-09-04
- Owner
- Chief Compliance Officer
- Approving authority
- Governance Library Maintainer
- Classification
- Public
- Confidentiality
- Public
- Category
- Compliance: Sector-Specific
- Review frequency
- Annual and upon material PCAOB guidance, COSO framework, or regulator change
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- Purpose
- Applicability triggers
- ICFR scope determination
- The four ITGC domains
- Auditor-expected artefacts beyond the library
- Library gaps requiring additional documentation
- Coordination with adjacent regimes
- Framework alignment
- Limitations
Frameworks it maps to
- Sarbanes-Oxley Act
- PCAOB Auditing Standard 2201
- COSO Internal Control Integrated Framework
- COSO ERM Framework
- C-SOX
- J-SOX
- SOC 1 reporting
- ITIL 4 and ISO/IEC 20000
Related documents
- compliance/
README.md (opens in a new tab) source - Compliance, Audit, and CAPA Management Policycompliance
- Internal Audit Standardcompliance
- Control Testing Procedurecompliance
- Corrective and Preventive Action (CAPA) Procedurecompliance
- Identity and Access Management Policysecurity
- Change Management and Configuration Control Procedureoperations
- IT Service Management Frameworkoperations
- Secure Development and Engineering Policydev-security
- Backup and Recovery Procedureresilience
Next
All Documents