BY NEURABYTE
FRAMEWORKS/FINANCIAL/SOX ITGC
SOX
FINANCIAL · SEC / PCAOB

SOX ITGC

IT general controls over financial reporting.

Section 404 of Sarbanes-Oxley requires management and auditors to assess internal control over financial reporting. IT general controls (ITGCs) cover access, change management, and operations for systems that feed the financial statements. Auditors test them every year.

AT A GLANCE
ISSUERSEC / PCAOB REGIONUS public companies CATEGORYFinancial CROSSWALKVersioned mapping onto the 15-control registry
EVIDENCE, NOT CERTIFICATION
01. WHO IT APPLIES TO

Is this one yours?

01US-listed companies and foreign private issuers
02Pre-IPO companies preparing for 404(b)
03Any agent that touches an in-scope financial system
02. KEY REQUIREMENTS

The parts of SOX ITGC that touch what agents do.

Logical access
Access to financial systems is restricted, approved, and periodically reviewed.
Change management
Changes are authorized, tested, approved by someone other than the developer, and tracked.
Segregation of duties
No single person or agent can initiate and approve the same transaction.
Computer operations
Job scheduling, backups, and incidents are monitored and evidenced.
03. HOW LORE MAPS TO IT

Enforcement controls, read against the requirement.

These controls exist because the platform needs them to run safely. The crosswalk reads their signed evidence against SOX ITGC. Where there is no evidence, the report says gap.

LORE CONTROL SOX ITGC REFERENCE
Blocking authorization gateLogical access
Maker–checker approvalChange management, segregation of duties
Signed, hash-chained receiptsEvidence of operating effectiveness
Context disclosure recordData integrity of inputs
Illustrative references. The shipped crosswalk carries exact clause citations, its version, and the review date.
04. OUT OF SCOPE

What Lore will not claim.

Scoping which systems are in scope for 404 is done with your auditors.
Business process controls and financial close are outside the platform.
05. QUESTIONS
Can an agent post journal entries under SOX?
Only with the same segregation of duties a human would need. Maker-checker enforces that the approver is a different identity.
Will auditors accept receipts as evidence?
Receipts are exactly the kind of system-generated, tamper-evident evidence ITGC testing looks for. Your auditors decide what they rely on.
Is this live?
Planned, available on request.
← PREVIOUS23 NYCRR 500 ALL FRAMEWORKS NEXT →NIST SP 800-53
SOX ITGC · EARLY ACCESSEVIDENCE COLLECTED ONCE

Start building the record your auditor will read.

Every receipt Lore signs today is evidence for SOX ITGC tomorrow. Turn the crosswalk on when you are ready; nothing needs re-collecting.

Also from Neurabyte: Cupel
Lore's core mechanisms are patent-pending. Product names are trademarks of their respective owners; listing an integration doesn't imply a partnership.
© 2026 NEURABYTE INC.