Title: SOX and ITGC readiness > SOX and ITGC readiness for UK organisations: scope the IT general controls and evidence for the financial-reporting requirements that apply to your group. Source: https://aegentra.co.uk/services/govern/sox Publisher: Aegentra (aegentra.co.uk), United Kingdom edition. Prices in GBP excluding VAT. Published: 2026-10-21 Updated: 2026-10-21 Licence: public web content; cite the source URL. Govern / United Kingdom # SOX and ITGC readiness Prepare scoped IT general controls and evidence for the financial-reporting requirements that apply to your group. Last reviewed 21 October 2026. Fees in pounds sterling plus VAT. [Discuss your scope](https://aegentra.co.uk/contact?subject=SOX%20and%20ITGC%20readiness) [See a working example](https://aegentra.co.uk/services/govern/sox#working-example) Which systems support the financial-reporting controls? Scope and fee ## Agree the work. Know the boundary. The written proposal defines the scope, responsibilities, price and delivery timetable. ### What shapes your quote - Scope, complexity and existing evidence - Required specialist work and access arrangements - Depth of reporting and any separately agreed follow-up [Request a scoped proposal](https://aegentra.co.uk/contact?subject=SOX%20and%20ITGC%20readiness) The requirement in context ## Define the requirement before selecting the work. For a UK business within a US-reporting group, start with the group’s applicable reporting requirement and the external auditor’s scope. Do not assume SOX applies to every UK organisation. Primary references [PCAOB: internal control over financial reporting](https://pcaobus.org/oversight/standards/auditing-standards/details/AS2201) Inside the work ## Which systems support the financial-reporting controls? Original fictional working example. The actual criteria, evidence, scope and delivery arrangements are agreed for your organisation. | Work area | Decision to make | Evidence to retain | | --- | --- | --- | | Scope | Identify relevant financial systems, interfaces and reports. | Approved scope and risk/control mapping. | | Control operation | Define access, change and operations responsibilities. | Owner, frequency, approvals and evidence. | | Readiness | Test whether evidence is complete and reproducible. | Gaps, remediation owner and retest record. | Fictional example · Not a client result, legal determination or complete audit checklist. [Download this working example (CSV)](https://aegentra.co.uk/downloads/govern-sox-working-example.csv) What you take away ## Evidence. Ownership. A practical next step. Prepare scoped IT general controls and evidence for the financial-reporting requirements that apply to your group. - Agreed in-scope systems and reporting requirements - Control and ownership mapping - Evidence design and readiness observations - Remediation planning and auditor coordination within scope ### Separate responsibilities This is readiness support, not a statutory audit opinion or legal determination that SOX applies. External-auditor reliance and testing requirements must be agreed with the relevant auditor. How the work moves forward ## From the requirement to a usable result. Responsibilities and access are agreed before the engagement. Work stays connected to the outcome—not the number of documents produced. - ### Understand the requirement Define the product, service, process and relevant external requirement. - ### Build the record Assign responsibilities and connect decisions to operating evidence. - ### Review and improve Check what is working, address gaps and agree the next review. A practical starting point ## Which systems support the financial-reporting controls? For a UK business within a US-reporting group, start with the group’s applicable reporting requirement and the external auditor’s scope. Do not assume SOX applies to every UK organisation. Fictional working exampleScope — Identify relevant financial systems, interfaces and reports. — Approved scope and risk/control mapping. Control operation — Define access, change and operations responsibilities. — Owner, frequency, approvals and evidence. Readiness — Test whether evidence is complete and reproducible. — Gaps, remediation owner and retest record. Before you commission the work ## Your questions. Clear answers. **Which systems support the financial-reporting controls?** For a UK business within a US-reporting group, start with the group’s applicable reporting requirement and the external auditor’s scope. Do not assume SOX applies to every UK organisation. **What is included in the engagement?** Agreed in-scope systems and reporting requirements; Control and ownership mapping; Evidence design and readiness observations; Remediation planning and auditor coordination within scope. The proposal defines the exact outputs and acceptance criteria. **What is not automatically included?** This is readiness support, not a statutory audit opinion or legal determination that SOX applies. External-auditor reliance and testing requirements must be agreed with the relevant auditor. **What does the service cost?** UK service fees are quoted for the agreed scope. We confirm a quote after reviewing the agreed boundary, starting position, dependencies and required deliverables. **How should we share evidence?** Agree secure access, minimisation and retention before work starts. Describe the requirement in the enquiry; do not send passwords or sensitive records through the form. **Is UK SOX the same requirement as US SOX?** No. Establish whether the requirement comes from US financial-reporting obligations, a group control framework or the UK Corporate Governance Code. The FRC’s revised Provision 29 is not a blanket SOX law for every UK business. Confirm applicability with the organisation’s finance and legal advisers before scoping controls. **Where should ITGC readiness start?** Start with significant financial processes and the systems supporting them, then identify relevant access, change and operations controls. Reconcile system populations and evidence owners with finance. A broad cybersecurity checklist alone does not establish financial-reporting control coverage. **What should we prepare for a scoping conversation?** Describe the organisation, product or service, customer requirement, systems and preferred timing. Do not send passwords or confidential records through the enquiry form. We agree secure evidence handling separately. ## Resources for this decision. [FRC: UK Corporate Governance Code](https://www.frc.org.uk/library/standards-codes-policy/corporate-governance/uk-corporate-governance-code/) Choose the right route ## Connected work. Distinct responsibilities. Commission organisational support, build your own knowledge or clarify what a customer has requested. ### Related services [SOX ITGC testing](https://aegentra.co.uk/services/govern/sox-itgc-testing) [ISO 27001 implementation](https://aegentra.co.uk/services/govern/iso-27001) ### Clarify your requirement [Read the decision guide](https://aegentra.co.uk/knowledge/course-or-consultancy) ## Let’s define the work you actually need. Tell us what you need to achieve, what is in scope and where you are starting. [Talk about your project](https://aegentra.co.uk/contact)