Title: SOX ITGC testing > SOX ITGC testing for UK subsidiaries and groups: agreed IT general controls tested with traceable evidence, defined populations and exceptions. Source: https://aegentra.co.uk/services/govern/sox-itgc-testing Publisher: Aegentra (aegentra.co.uk), United Kingdom edition. Prices in GBP excluding VAT. Published: 2026-10-21 Updated: 2026-10-21 Licence: public web content; cite the source URL. Internal audit / United Kingdom # SOX ITGC testing Test agreed IT general controls with traceable evidence, defined populations and clear reporting of exceptions. Last reviewed 21 October 2026. Fees in pounds sterling plus VAT. [Discuss your scope](https://aegentra.co.uk/contact?subject=SOX%20ITGC%20testing) [See a working example](https://aegentra.co.uk/services/govern/sox-itgc-testing#working-example) Can you trace the sample back to the full population? Scope and fee ## Agree the work. Know the boundary. The written proposal defines the scope, responsibilities, price and delivery timetable. ### What shapes your quote - Scope, complexity and existing evidence - Required specialist work and access arrangements - Depth of reporting and any separately agreed follow-up [Request a scoped proposal](https://aegentra.co.uk/contact?subject=SOX%20ITGC%20testing) The requirement in context ## Define the requirement before selecting the work. Before evaluating a control, agree the population, period and evidence of completeness. A clean sample from an incomplete population does not establish that all relevant activity was covered. Primary references [PCAOB: internal control over financial reporting](https://pcaobus.org/oversight/standards/auditing-standards/details/AS2201) Inside the work ## Can you trace the sample back to the full population? Original fictional working example. The actual criteria, evidence, scope and delivery arrangements are agreed for your organisation. | Work area | Decision to make | Evidence to retain | | --- | --- | --- | | Population | Define in-scope users, changes or events and the testing period. | Extraction method and completeness checks. | | Sample | Agree the selection method and supporting records. | Traceable identifiers and evidence. | | Exception | Evaluate the observation against the control. | Condition, impact, management response and retest scope. | Fictional example · Not a client result, legal determination or complete audit checklist. [Download this working example (CSV)](https://aegentra.co.uk/downloads/govern-sox-itgc-testing-working-example.csv) What you take away ## Evidence. Ownership. A practical next step. Test agreed IT general controls with traceable evidence, defined populations and clear reporting of exceptions. - Testing objectives, scope and independence assessment - Population completeness and sample approach - Agreed control testing and exception evaluation - Report and management follow-up evidence ### Separate responsibilities Testing is not a statutory audit opinion or automatic external-auditor reliance. Control design support, remediation and retesting must be scoped and conflicts assessed. How the work moves forward ## Agree. Examine. Follow up. Responsibilities and access are agreed before the engagement. Work stays connected to the outcome—not the number of documents produced. - ### Agree criteria Confirm scope, competence, impartiality and evidence access. - ### Examine records Use agreed sampling and trace findings to evidence. - ### Report and follow up State conclusions, limitations and required management actions. A practical starting point ## Can you trace the sample back to the full population? Before evaluating a control, agree the population, period and evidence of completeness. A clean sample from an incomplete population does not establish that all relevant activity was covered. Fictional working examplePopulation — Define in-scope users, changes or events and the testing period. — Extraction method and completeness checks. Sample — Agree the selection method and supporting records. — Traceable identifiers and evidence. Exception — Evaluate the observation against the control. — Condition, impact, management response and retest scope. Before you commission the work ## Your questions. Clear answers. **Can you trace the sample back to the full population?** Before evaluating a control, agree the population, period and evidence of completeness. A clean sample from an incomplete population does not establish that all relevant activity was covered. **What is included in the engagement?** Testing objectives, scope and independence assessment; Population completeness and sample approach; Agreed control testing and exception evaluation; Report and management follow-up evidence. The proposal defines the exact outputs and acceptance criteria. **What is not automatically included?** Testing is not a statutory audit opinion or automatic external-auditor reliance. Control design support, remediation and retesting must be scoped and conflicts assessed. **What does the service cost?** UK service fees are quoted for the agreed scope. We confirm a quote after reviewing the agreed boundary, starting position, dependencies and required deliverables. **How should we share evidence?** Agree secure access, minimisation and retention before work starts. Describe the requirement in the enquiry; do not send passwords or sensitive records through the form. **What evidence should ITGC testing retain?** Agree the control objective, population, period, sampling rationale, evidence, exceptions and reviewer. Keep the distinction between control design and execution clear. Any reliance by an external auditor is their decision, not a promise made in the testing proposal. **Can remediation work and independent testing be combined?** They need distinct responsibilities and explicit safeguards. If the same person designed or operated a control, assess the conflict before assigning testing. Record management’s actions and the basis for any follow-up conclusion rather than marking a control effective because a document changed. **What should we prepare for a scoping conversation?** Describe the organisation, product or service, customer requirement, systems and preferred timing. Do not send passwords or confidential records through the enquiry form. We agree secure evidence handling separately. Choose the right route ## Connected work. Distinct responsibilities. Commission organisational support, build your own knowledge or clarify what a customer has requested. ### Related services [SOX and ITGC readiness](https://aegentra.co.uk/services/govern/sox) [ISO 27001 internal audit](https://aegentra.co.uk/services/govern/iso-27001-internal-audit) ### Clarify your requirement [Read the decision guide](https://aegentra.co.uk/knowledge/course-or-consultancy) ## Let’s define the work you actually need. Tell us what you need to achieve, what is in scope and where you are starting. [Talk about your project](https://aegentra.co.uk/contact)