SOX, ITGC & change management as risk + evidence

Use these terms correctly, because the people you're selling to live in them. SOXSarbanes-Oxley Act. A US law that forces companies to keep auditable controls over any system that affects their financial reporting. Press Enter for the full definition. (Sarbanes-Oxley) makes executives personally accountable for the accuracy of financial reporting. Financial data lives in software, so the controls over who can change that software fall under SOX scope. ITGCIT General Controls. The baseline IT controls auditors check: who can change what, how changes get approved and how systems are run. Press Enter for the full definition. (IT General Controls) is the bucket those controls live in: change management, access management, operations.