Independent SOX ITGC testing in Australia.

A sample is only meaningful in relation to the population it was selected from. Establish the report source, date range, filters and relevant systems, and consider completeness and accuracy before relying on it. For example, testing only ordinary change tickets can miss emergency changes stored elsewhere. Workpapers should explain the population and selection method, not simply list the records that were easiest to obtain.

Not automatically. The conclusion depends on the control, frequency, risk, period and testing approach. Distinguish design effectiveness from operating effectiveness and document the period supported by the evidence. A walkthrough or a single recent approval should not be presented as proof for an entire year without a justified basis. Agree testing and any period-end procedures with the responsible assurance team.

No. Aegentra’s published SOX testing policy excludes testing controls it designed, implemented or remediated. Management or another provider should perform the remediation, with testing responsibilities agreed to preserve objectivity. A retest should examine relevant new evidence and identify the period and limitation of its conclusion. It does not erase the original exception or automatically establish effectiveness across the earlier period.

No. A Section 404(b) integrated audit and opinion are performed by a PCAOB-registered public accounting firm. This service is management-side testing that supports the Section 404(a) assessment. Our workpapers are structured for review, but the external auditor independently decides whether and how much to use the work.

Often you do not. The need usually arises when a regional internal audit team cannot cover the Australian entity in the testing window or needs specialist depth across Microsoft Entra ID, a local ERP or a material interface. We can co-source under the group methodology, review conventions and reporting lines so the work sits inside the existing programme.

No. Aegentra does not test controls it designed, implemented or remediated. Those controls must be tested by a separate provider. We confirm prior involvement and tester objectivity before accepting the testing scope.

Interim testing should be early enough to leave a genuine remediation and re-performance window. Testing performed before the reporting date must then be extended with appropriate roll-forward work. The amount of additional evidence depends on the control risk, the interim result, the length of the remaining period and any changes to the control.

No — they are different frameworks with different mandates and audiences, and we scope them separately. SOX is US securities law governing internal control over financial reporting for listed companies and their subsidiaries. SOC 2 is a voluntary attestation about a service organisation's controls, usually driven by customer due diligence. The control work overlaps in places; the obligations do not. There is a full comparison in our SOX compliance in Australia guide.

Only those that affect financial reporting — typically the ERP or accounting platform, the identity layer controlling access to it (usually Microsoft Entra ID), any system feeding material transactions into it, and the infrastructure supporting them. Scoping is driven by materiality from the parent's programme. Third-party platforms are usually covered through their SOC 1 Type II report and the complementary user-entity controls it assumes you operate.

An agreed scope and test plan, a traceable workpaper for every control tested, design and operating-effectiveness conclusions, documented exceptions, a management-ready findings register and remediation priorities. The file is structured for external-auditor review, but reliance remains the external auditor's decision.