Govern / United Kingdom
SOX and ITGC readiness
Prepare scoped IT general controls and evidence for the financial-reporting requirements that apply to your group.
Last reviewed . Fees in pounds sterling plus VAT.
Which systems support the financial-reporting controls?
Scope and fee
Agree the work.
Know the boundary.
The written proposal defines the scope, responsibilities, price and delivery timetable.
What shapes your quote
- Scope, complexity and existing evidence
- Required specialist work and access arrangements
- Depth of reporting and any separately agreed follow-up
The requirement in context
Define the requirement before selecting the work.
For a UK business within a US-reporting group, start with the group’s applicable reporting requirement and the external auditor’s scope. Do not assume SOX applies to every UK organisation.
Primary references
PCAOB: internal control over financial reportingInside the work
Which systems support the financial-reporting controls?
Original fictional working example. The actual criteria, evidence, scope and delivery arrangements are agreed for your organisation.
| Work area | Decision to make | Evidence to retain |
|---|---|---|
| Scope | Identify relevant financial systems, interfaces and reports. | Approved scope and risk/control mapping. |
| Control operation | Define access, change and operations responsibilities. | Owner, frequency, approvals and evidence. |
| Readiness | Test whether evidence is complete and reproducible. | Gaps, remediation owner and retest record. |
Fictional example · Not a client result, legal determination or complete audit checklist.
Download this working example (CSV)What you take away
Evidence.
Ownership.
A practical next step.
Prepare scoped IT general controls and evidence for the financial-reporting requirements that apply to your group.
- Agreed in-scope systems and reporting requirements
- Control and ownership mapping
- Evidence design and readiness observations
- Remediation planning and auditor coordination within scope
How the work moves forward
From the requirement to a usable result.
Responsibilities and access are agreed before the engagement. Work stays connected to the outcome—not the number of documents produced.
Understand the requirement
Define the product, service, process and relevant external requirement.
Build the record
Assign responsibilities and connect decisions to operating evidence.
Review and improve
Check what is working, address gaps and agree the next review.
A practical starting point
Which systems support the financial-reporting controls?
For a UK business within a US-reporting group, start with the group’s applicable reporting requirement and the external auditor’s scope. Do not assume SOX applies to every UK organisation.
Scope — Identify relevant financial systems, interfaces and reports. — Approved scope and risk/control mapping. Control operation — Define access, change and operations responsibilities. — Owner, frequency, approvals and evidence. Readiness — Test whether evidence is complete and reproducible. — Gaps, remediation owner and retest record.
Before you commission the work
Your questions.
Clear answers.
Which systems support the financial-reporting controls?
For a UK business within a US-reporting group, start with the group’s applicable reporting requirement and the external auditor’s scope. Do not assume SOX applies to every UK organisation.
What is included in the engagement?
Agreed in-scope systems and reporting requirements; Control and ownership mapping; Evidence design and readiness observations; Remediation planning and auditor coordination within scope. The proposal defines the exact outputs and acceptance criteria.
What is not automatically included?
This is readiness support, not a statutory audit opinion or legal determination that SOX applies. External-auditor reliance and testing requirements must be agreed with the relevant auditor.
What does the service cost?
UK service fees are quoted for the agreed scope. We confirm a quote after reviewing the agreed boundary, starting position, dependencies and required deliverables.
How should we share evidence?
Agree secure access, minimisation and retention before work starts. Describe the requirement in the enquiry; do not send passwords or sensitive records through the form.
Is UK SOX the same requirement as US SOX?
No. Establish whether the requirement comes from US financial-reporting obligations, a group control framework or the UK Corporate Governance Code. The FRC’s revised Provision 29 is not a blanket SOX law for every UK business. Confirm applicability with the organisation’s finance and legal advisers before scoping controls.
Where should ITGC readiness start?
Start with significant financial processes and the systems supporting them, then identify relevant access, change and operations controls. Reconcile system populations and evidence owners with finance. A broad cybersecurity checklist alone does not establish financial-reporting control coverage.
What should we prepare for a scoping conversation?
Describe the organisation, product or service, customer requirement, systems and preferred timing. Do not send passwords or confidential records through the enquiry form. We agree secure evidence handling separately.
Resources for this decision.
FRC: UK Corporate Governance CodeLet’s define the work you actually need.
Tell us what you need to achieve, what is in scope and where you are starting.
Talk about your project