SOX compliance in Australia
Australia has no Sarbanes-Oxley Act — yet Australian finance and IT teams are asked for SOX evidence every year. This guide explains how the obligation actually reaches an Australian entity, which IT controls get tested, and how SOX differs from the ISO 27001 and SOC 2 programs you may already run.
The short answer
SOX can apply directly to an Australian company that is an SEC reporting issuer, including a foreign private issuer. An Australian subsidiary may also enter its parent’s internal-control programme through group scoping. Section 404(a) management assessment and Section 404(b) auditor attestation are distinct: exemptions and transition provisions depend on issuer status. Agree applicable requirements, financial-reporting risks, systems and evidence with the issuer’s finance team, advisers and external auditor.
404
The SOX section that requires management to assess internal control over financial reporting
Sarbanes-Oxley Act 2002
302
The section requiring principal executive and financial officer certifications in applicable periodic reports
Sarbanes-Oxley Act 2002
4
Common ITGC groupings — access, change, development, operations
Illustrative control grouping
2
Distinct Section 404 requirements: management assessment and auditor attestation, subject to applicability
SEC guidance
Key takeaways
- Australian entities can be directly subject to SEC reporting requirements or included in an issuer’s group scope. Confirm which route applies.
- SOX internal-control scope follows financial-reporting risks and dependencies. ISO 27001 also has a defined scope; neither automatically covers the whole IT estate.
- ITGC is the IT half of the work: access, change, development and operations controls over in-scope financial systems.
- The testing bar is a financial-audit standard. Evidence must show a control operated on a specific date for a specific item, not that a policy exists.
- Existing ISO 27001 or SOC 2 evidence may be reusable where scope, period and control objectives match; it does not replace SOX-specific assessment.
Does SOX apply to Australian companies?
SOX is US federal law, but Australian incorporation does not prevent direct application. An Australian SEC reporting issuer may have SOX obligations, including when it qualifies as a foreign private issuer. An Australian subsidiary can also be included in its parent's group assessment.
Section 404(a) concerns management's ICFR assessment. Section 404(b) concerns auditor attestation where required. Certain issuers, including eligible emerging growth companies, have exemptions; newly public entities may have transition provisions. Confirm current filer status and reporting requirements before fixing the control programme or audit timetable.
For a subsidiary, begin with the issuer's finance and SOX programme teams and its external auditor. Financial-reporting risks and materiality determine the relevant entities, processes, systems and evidence. This guide does not determine a particular company's legal obligations.
Who inherits the obligation in Australia
These examples distinguish direct issuer obligations, group requirements and contractual assurance requests. Their scope and timing differ.
Australian subsidiary of a US-listed parent
Group policy and intercompany agreements push the parent’s Section 404 program down to material entities
Australian company that is an SEC reporting issuer
US reporting requirements can apply directly, including to foreign private issuers; confirm filer status, exemptions and transition provisions
Pre-IPO company targeting a US listing
SOX readiness is expected during due diligence; newly public companies get limited relief but must be ready
Australian service provider to a US-listed client
Financial-reporting dependencies may create contractual evidence requests, such as a relevant SOC 1 report; providing a service does not by itself make the provider an SEC issuer
The four ITGC domains an auditor tests
Financial-reporting controls include business-process, application and IT general controls. These four groupings help organise ITGC work; they are not a mandatory universal audit scope. The auditor selects controls and procedures based on risk, including evidence of operation where relevant.
Access to programs and data
User provisioning and de-provisioning, privileged access, periodic access reviews, segregation of duties, password and MFA configuration
Program change management
Change requests authorised, tested and approved before production; separation of development from production; emergency-change handling
Program development
New systems and major implementations follow a documented SDLC, with data-conversion and go-live approvals evidenced
Computer operations
Job scheduling and monitoring, incident handling, backup and restore testing, and third-party/cloud provider oversight
A first-year SOX ITGC program, step by step
Confirm scope with the parent
Materiality is set at group level. Agree with the parent’s SOX PMO which of your entities, processes and systems are in scope before you build anything — scoping the wrong systems is the most expensive mistake in a first-year program.
Map financial systems and their dependencies
Identify the applications that record, process or report financial transactions, then the infrastructure underneath them — identity provider, databases, hosting, integrations, and any outsourced provider that touches the data.
Document the ITGC control set
Write the control descriptions the auditor will test against: who approves access, how changes reach production, how jobs are monitored, how backups are proven. Descriptions must match what actually happens, not the aspiration.
Remediate the gaps
Typical first-year findings are the same everywhere: shared admin accounts, no periodic access review, developers with production write access, changes deployed without recorded approval, no evidence that backups restore.
Evidence continuously, not in audit week
Auditors sample across the whole period. Controls that only operated in the month before fieldwork fail. Evidence collection has to run all year — this is where a live evidence engine pays for itself.
Walk the auditor through it
Walkthroughs, sample selections, and exception handling. Evaluate deficiencies individually and together, including compensating controls. Material weaknesses affect ICFR reporting; significant deficiencies also require communication to the relevant governance bodies. Public disclosure obligations need case-specific assessment.
SOX vs ISO 27001 vs SOC 2
These three get conflated, and treating one as a substitute for another is a fast way to fail an audit. The controls overlap heavily — access, change and operations appear in all three — so a mature ISO 27001 or SOC 2 program gives you a real head start, and evidence can be reused wherever it is valid. But the objective, the scope and the testing bar are different in each.
| SOX ITGC | ISO 27001 | SOC 2 | |
|---|---|---|---|
| Status | Mandatory under US law | Voluntary certification | Voluntary attestation |
| Objective | Reliable financial reporting | Confidentiality, integrity, availability | Security of a service |
| Scope | Financial systems only | Whole ISMS you define | The service and its criteria |
| Who tests | Management assessment; external auditor attestation where required | Accredited certification body | Licensed CPA firm |
| Cycle | Applicable annual reporting requirements | Three-year cycle with surveillance | Type I at a date; Type II over an agreed period |
| Output | Management report; auditor opinion where required | Certificate | Restricted-use report |
If you hold ISO 27001 already, the efficient play is to map your Annex A controls to the ITGC matrix, reuse the evidence that genuinely covers a SOX control, and treat the remainder as net-new work. We run that mapping as the opening step of a SOX ITGC readiness engagement. If your buyers are asking for SOC 2 rather than an ISO certificate, that is a separate readiness program with its own criteria.
Where Australian entities usually fail
First-year findings are remarkably consistent across Australian subsidiaries, and almost none of them are exotic. They are the ordinary consequences of a small IT team that has never been sampled by a financial auditor.
- Shared or generic administrator accounts in a financial system — no way to attribute an action to a person.
- No periodic access review, or a review with no evidence of who performed it and what changed as a result.
- Developers with standing write access to production, with no compensating control documented.
- Changes deployed with approval recorded in chat rather than in the change system the control description names.
- Backups configured but never restore-tested, so the operations control cannot be evidenced.
- Cloud and outsourced providers with no assurance report obtained or reviewed.
- Evidence gathered only in audit week, so sampling across the period fails immediately.
FAQ
SOX in Australia — questions we get asked.
Does SOX apply to Australian companies?
It can apply directly to an Australian SEC reporting issuer, including a foreign private issuer. Subsidiaries may also be included in a parent’s assessment through group scoping. Management assessment and auditor attestation are separate requirements; Section 404(b) exemptions and transition provisions depend on issuer status. Confirm applicability with the issuer’s advisers.
What is ITGC and why does it matter for SOX?
IT general controls support the systems and reports used in financial reporting. A deficiency can affect reliance on particular automated controls or information. The auditor evaluates the affected risks, other controls and available evidence, then determines any additional procedures; one weakness does not automatically invalidate every system or make the entire audit substantive.
Is SOX the same as SOC 2?
No. SOX concerns applicable US financial-reporting and governance obligations. Section 404 assessment and, where required, auditor attestation concern internal control over financial reporting. SOC 2 is a separate CPA assurance engagement over a defined service system and selected Trust Services Criteria. Neither substitutes for the other.
Does ISO 27001 certification satisfy SOX?
No. Relevant access, change and operations evidence may be reusable, but an ISMS certificate does not establish SOX compliance. Financial-reporting scope, risk, control objectives, testing periods and evidence must be assessed separately.
When does a pre-IPO company need to be SOX ready?
Sooner than most expect. Underwriters and diligence teams ask about internal control readiness before the listing, and newly public companies face management’s assessment obligations quickly after — with only limited transitional relief depending on filer status. Practically, companies targeting a US listing start the ITGC program a year or more ahead so the first assessment is not also the first time controls have operated.
What is a material weakness?
The most serious grade of deficiency: a control deficiency, or combination of them, such that there is a reasonable possibility a material misstatement of the financial statements would not be prevented or detected on a timely basis. Material weaknesses are disclosed publicly by the parent, which is why groups invest heavily in closing significant deficiencies before year-end.
Who can help with SOX in Australia?
Management remains responsible for controls. External-auditor independence rules restrict management functions and certain design or implementation services; they do not prohibit every recommendation for improvement. Agree permissible roles and any required audit-committee approval. Aegentra provides separately scoped ITGC readiness and remediation support, with supported evidence collection where Aeges access and permissions are agreed. The external auditor determines its own procedures and reliance.
SOX request list landed on your desk?
We scope with your parent's SOX program office, remediate the ITGC gaps in your agreed scope, and help organise evidence across the required period. The external auditor retains responsibility for its assurance opinion.
See SOX ITGC readiness