SOX ITGC readiness for Australian entities.

Start with financial-reporting risks and the processes and information supporting the relevant accounts and disclosures. Trace dependencies through applications, interfaces, reporting tools, infrastructure and access administration. An application inventory alone does not establish SOX scope. Agree the boundary with the responsible finance, legal and audit teams; this is not an assumption that every IT system requires the same controls.

Each control should identify the risk addressed, owner, activity, frequency, evidence and how exceptions are handled. Make it possible to distinguish the control design from proof that it operated. For an access review, identify the population and reviewer, the decision recorded and follow-through on removals. A generic matrix that cannot be connected to actual systems and records is not a substitute for operating controls.

Record the gap honestly and agree its treatment with management and the relevant audit team. Do not backdate approvals or recreate records as if they were contemporaneous. Establish what reliable evidence does exist, whether additional procedures are appropriate and how evidence will be retained going forward. Readiness support cannot promise that a newly implemented control proves effectiveness throughout an earlier period.

Not as Australian law — it reaches you through ownership and US market plans. Your Australian entity is in scope when it is a subsidiary of a US-listed parent or SEC registrant and is material to the group’s consolidated financial statements, when you are preparing for a Nasdaq or NYSE IPO, or when you are a foreign private issuer with US-listed ADRs. In those cases the IT General Controls over your financially-relevant systems have to meet SOX standards, with scope and any external attestation requirements confirmed by the group’s finance, legal and audit teams.

Section 302 is a per-filing certification: the CEO and CFO personally certify, in every 10-Q and 10-K, that the financial statements are accurate and that they have evaluated the disclosure controls behind them. Section 404 is an annual assessment of the control system itself — 404(a) requires management to formally assess and report on the effectiveness of internal control over financial reporting, and 404(b), where applicable to the issuer, requires external-auditor attestation. Emerging growth companies can be exempt from 404(b); confirm the issuer’s status and other exemptions with its advisers.

No, and the distinction is deliberate. This page is readiness — we scope, remediate and build the controls, then set up the evidence capture. SOX ITGC testing is the independent testing of controls someone else built, supporting management’s 404(a) assertion. We do not test controls we built ourselves; that would defeat the purpose of the testing.

A useful amount, but less than people hope. Your Annex A controls for access, change and operations map onto the ITGC matrix, and mature evidence practices carry across directly. What does not carry across is scoping and rigour: SOX scopes tightly to systems that touch the numbers and tests to financial-audit standards, which is a higher evidentiary bar than most ISMS internal audits apply. We start by mapping what genuinely covers a SOX control and treat the rest as net-new.

No. The ERP or accounting platform is almost always the centre of scope, and it is rarely Microsoft. What Microsoft 365 usually provides is the identity layer in front of everything — which is why access controls are where we start. Third-party platforms are typically covered through their SOC 1 Type II report and the complementary user-entity controls it assumes you operate; we check those assumptions actually hold.

Earlier than feels necessary. A control has to operate across the period to be testable, so a control built in month eleven has almost no population for the auditor to sample — this can limit the available operating evidence. Start early enough to meet the agreed evidence period; management and the external auditor determine the effect of any evidence gaps.

Management does. SOX makes named executives personally accountable for the assertion, and no consultant can take that on. What we provide is the control environment and the evidence that makes the assertion defensible, plus the workpaper trail the external auditor will ask to see.