Application Access in SOX IT General Controls

Where does application access fit in a SOX audit?

An audit of internal control over financial reporting under PCAOB AS 2201 includes the IT that supports financial transactions. The standard says "The auditor also should understand how IT affects the company's flow of transactions" and that "The identification of risks and controls within IT is not a separate evaluation." Access to the applications that process financial data is part of that understanding, usually tested as IT general controls.

Which access controls are usually tested?

In practice auditors look at four things for each in-scope application: how access is requested and approved, how it is removed when people leave, how often it is reviewed, and who holds privileged access. Each test starts from a population: the list of accounts in the application at a point in time.

Why do apps outside the IGA make this harder?

For an application connected to the IGA, the population comes from the IGA and the removals are logged there. For an application outside it, the population is an export from the application itself, the leaver test means comparing that export with HR records by hand, and the review is often a spreadsheet signed by email. Local and service accounts in the export may have no link to a person at all. The more applications in scope sit outside central control, the more of the audit is rebuilt by hand each year.

What evidence helps?

A dated account list per application, with each account matched to a person, a system or an owner.
A record of when each leaver's accounts were removed, application by application.
Review decisions with the reviewer, date and outcome.
A list of privileged and local accounts with their custodians.

What do the scored vendors document?

Orchid Security describes continuous, application-level identity evidence mapped to SOX, PCI, HIPAA, GDPR and NIS2, including for unmanaged applications. SailPoint states it collects audit evidence automatically and generates audit-ready reports on demand. Saviynt describes continuous compliance monitoring and audit evidence collection. The Audit evidence criterion in the rankings scores what each vendor documents. NIST SP 800-53 control family AC, account management, is the reference many control frameworks map to.