SOX IT General Controls (ITGC)
Version: FintastIQ ITGC model v1 (aligned to PCAOB AS 2201 and COSO 2013)
FintastIQ's own model of the IT general controls that external auditors test under PCAOB AS 2201 for systems that support financial reporting under Sarbanes-Oxley Section 404. Organized into the four standard ITGC domains: access to programs and data, program changes, computer operations, and program development.
Where we stand
Controls
66%
Evidence
44%
Policies
5%
18 of 24 clauses mapped to adopted controls · 1 known gap
As of (just now)
Percentages are over clauses mapped to at least one adopted control. Unmapped clauses are listed below and never count as passing. A known gap is a clause that applies to us and that no control covers yet.
Clause-by-clause readiness
| Clause | Title | Controls | Evidence | Policies | Last tested |
|---|---|---|---|---|---|
| ITGC-ACC Access to programs and data | |||||
| ITGC-ACC-1 | User provisioning approval Controls: IAM-07 | Not passing | Current | Not approved | (29 d ago) |
| ITGC-ACC-2 | Timely deprovisioning Controls: PEOPLE-03 | Passing | Current | Not approved | (8 h ago) |
| ITGC-ACC-3 | Periodic user access review Controls: IAM-09 | Passing | Current | Not approved | (29 d ago) |
| ITGC-ACC-4 | Privileged and super-user access Controls: IAM-06, MON-03 | Not passing | Not current | Not approved | (29 d ago) |
| ITGC-ACC-5 | Password and authentication configuration Controls: IAM-01, IAM-02, IAM-08 | Not passing | Not current | Not approved | (8 h ago) |
| ITGC-ACC-6 | Segregation of incompatible duties Controls: BIZ-06, BIZ-15, IAM-05 | Passing | Not current | Not approved | (29 d ago) |
| ITGC-CHG Program changes | |||||
| ITGC-CHG-1 | Change request and authorization Controls: PDP-01, PDP-02 | Passing | Not current | Not approved | (23 d ago) |
| ITGC-CHG-2 | Testing before migration Controls: CLOUD-06, PDP-04 | Passing | Not current | Not approved | (29 d ago) |
| ITGC-CHG-3 | Approval before production Controls: PDP-03, PDP-05 | Not passing | Current | Not approved | (8 h ago) |
| ITGC-CHG-4 | Segregation of development from production deployment Controls: PDP-05 | Passing | Current | Not approved | (29 d ago) |
| ITGC-CHG-5 | Emergency changes | Unmapped | Unmapped | Unmapped | Not yet |
| ITGC-CHG-6 | Database and configuration changes Controls: CLOUD-02 | Passing | Current | Approved | (29 d ago) |
| ITGC-OPS Computer operations | |||||
| ITGC-OPS-1 | Batch and scheduled job monitoring | Unmapped | Unmapped | Unmapped | Not yet |
| ITGC-OPS-2 | Backup and restore Controls: DATA-12, DATA-13, DATA-14, DATA-15 | Passing | Not current | Not approved | (29 d ago) |
| ITGC-OPS-3 | Incident and problem management Controls: BIZ-02, BIZ-03 | Passing | Not current | Not approved | (8 h ago) |
| ITGC-OPS-4 | Job scheduling access Controls: CLOUD-02, IAM-04 | Passing | Not current | Not approved | (29 d ago) |
| ITGC-OPS-5 | Interface and data transfer completeness | Unmapped | Unmapped | Unmapped | Not yet |
| ITGC-OPS-6 | IT operations monitoring Controls: MON-03 | Not passing | Not current | Not approved | (3 mo ago) |
| ITGC-PD Program development | |||||
| ITGC-PD-1 | System acquisition and development methodology Controls: VEND-03 | Passing | Not current | Not approved | Not yet |
| ITGC-PD-2 | Requirements and user acceptance testing | Unmapped | Unmapped | Unmapped | Not yet |
| ITGC-PD-3 | Data conversion and migration validation | Unmapped | Unmapped | Unmapped | Not yet |
| ITGC-PD-4 | Go-live approval Controls: PDP-05 | Passing | Current | Not approved | (29 d ago) |
| ITGC-PD-5 | Vendor SOC report review and complementary user entity controls Controls: VEND-04 | Not passing | Current | Not approved | (8 h ago) |
| ITGC-PD-6 | End-user computing and report logic | Known gap | Known gap | Known gap | Not yet |