SOX
SOX access reviews and ITGC access controls
When a company falls under SOX, access to the systems behind the financial statements comes under scrutiny as part of IT general controls (ITGC). The core questions are familiar — who can touch financial-reporting systems, is access appropriate, and are incompatible duties kept apart — but the stakes are higher because auditors rely on these controls to trust the numbers. This guide covers where access reviews fit in SOX, how segregation of duties changes the picture, and what evidence holds up.
Access reviews as an IT general control
SOX doesn’t hand you a checklist of access procedures; it holds management responsible for internal control over financial reporting, and auditors evaluate the ITGCs that support the systems in scope. Access controls — who can log in, what they can do, and how access is granted and removed — are a central ITGC domain. A periodic review of access to financial-reporting systems is a common control used to show that access stays appropriate. There’s no legally mandated cadence or exact method; your control design defines those, and the auditor tests whether the control operated as designed across the period.
Segregation of duties is the SOX-specific twist
What sets SOX access reviews apart from a general SOC 2 review is the emphasis on segregation of duties (SoD): no single person should be able to both create and approve a transaction, or hold conflicting roles that let them push an error or fraud through to the financials. An access review over financial systems isn’t only “does this person still need access” — it’s also “does this combination of access create a conflict.” Reviewing access per user, with each person’s full set of roles visible, is what makes those conflicts surface instead of hiding across separate system lists.
What a SOX auditor tests
For financial-reporting systems in scope, expect testing along these lines:
- Access is granted through an approval, with a record of who authorized it.
- Periodic review of who has access, performed by an accountable owner and evidenced per line.
- Prompt removal of access on termination or role change, with proof.
- Privileged and administrator access is limited, justified, and reviewed more closely.
- A reliable audit trail — one the entity can’t quietly alter — over changes to access.
Why the audit trail has to be tamper-evident
SOX puts weight on the integrity of the evidence itself: if the record of access changes can be edited, an auditor can’t rely on it. Useboards writes every grant, revocation, approval, and role change to an append-only audit log — a database trigger rejects any update or delete on the log — so the trail is tamper-evident by construction. Combined with reviews that snapshot access at review-start, the evidence reflects what was true at the time and can’t be quietly rewritten later.
Running SOX access reviews in Useboards
Keep your financial-reporting systems in the catalog with their owners and access levels, route access through approval flows so grants are authorized, and run periodic user access reviews over the in-scope systems. Reviewers see each user’s full access, decide keep or revoke, and revokes become tracked deprovisioning. The append-only log and snapshot-based evidence give you what ITGC testing asks for without standing up an enterprise controls platform.
Frequently asked questions
Does SOX require access reviews at a specific frequency?
No. SOX makes management responsible for internal control over financial reporting; auditors evaluate the supporting IT general controls. A periodic access review over financial-reporting systems is a common ITGC control, but the cadence and method come from your control design — the auditor tests whether it operated as designed, not against a legal frequency.
How is a SOX access review different from a SOC 2 one?
The mechanics are similar — periodic certification of who has access — but SOX scopes to systems behind the financial statements and leans harder on segregation of duties: catching access combinations that let one person control conflicting steps. Reviewing each user’s full access set, not just per-system lists, is what makes those conflicts visible.
What is segregation of duties in this context?
It’s the principle that incompatible responsibilities — like initiating and approving the same transaction — shouldn’t sit with one person, so no individual can push an error or fraud through to the financials unchecked. Access reviews over financial systems are one place to detect and remediate access combinations that violate it.
Why does the audit trail matter so much for SOX?
Auditors rely on the record of access changes to trust the control; if that record can be edited, its evidentiary value drops. Useboards keeps an append-only audit log (a database trigger blocks updates and deletes) and snapshots review evidence at review-start, so the trail is tamper-evident and reflects what was true at the time.
Related
Run ITGC access reviews with evidence that holds
Approval flows, per-user reviews, and a tamper-evident audit log.