SOX ITGC Evidence Report
PCAOB AS 2201 IT General Controls evidence for public companies and pre-IPO startups — change authorization, segregation of duties, risk assessment, and logical access.
Overview
Sarbanes-Oxley (SOX) requires public companies to maintain effective internal controls over financial reporting (ICFR). IT General Controls (ITGCs) are the foundational layer — they govern access to systems, change management processes, and the integrity of the IT environment that produces financial data.
Koalr's SOX ITGC report generates evidence for four IT general controls aligned to PCAOB AS 2201 requirements. The report is designed for delivery to your external auditor (public accounting firm) during the annual SOX audit.
Controls covered
ITGC-1 — Change Management Authorization
Control language: All changes to production systems must be authorized and approved prior to implementation.
Koalr evidence: Every merged pull request has a recorded approver, review timestamp, and audit trail before reaching production. The report surfaces the approval coverage rate and lists any changes merged without required approval as ITGC exceptions.
ITGC-2 — Segregation of Duties
Control language: Individuals who develop or modify system changes must not be the same individuals who approve those changes for production.
Koalr evidence: Author-cannot-self-approve enforcement is tracked on every PR. Rubber-stamp approvals — defined as approved in under 2 minutes with zero review comments — are detected and flagged as potential segregation-of-duties violations.
ITGC-3 — Change Risk Assessment
Control language: All changes must be assessed for risk prior to deployment.
Koalr evidence: Automated deploy risk scoring evaluates every PR for DDL migrations, blast radius, CVE-adjacent paths, and complexity. Each change receives a documented risk classification (LOW / MEDIUM / HIGH / CRITICAL) before merge.
ITGC-4 — Logical Access to Programs and Data
Control language: Access to production programs and data must be restricted to authorized individuals.
Koalr evidence: CODEOWNERS rules define which individuals are authorized to approve changes to protected code paths. Every merge is checked; violations (unauthorized merges to protected paths) are detected and logged.
Report output
- Dark navy cover page prepared for "External Auditor (PCAOB / Financial Statement Audit)"
- Executive summary with six KPI tiles (total changes, approval rate, rubber-stamp count, risk-scored changes, CODEOWNERS violations, avg risk score)
- Per-control detail blocks with EVIDENCED / PARTIAL / NOT_COVERED status badges
- Change log table with approval, CODEOWNERS, and risk columns
- Page number footer with CONFIDENTIAL marking
- Machine-readable CSV export
Generating a report
- Navigate to Compliance → SOX ITGCs
- Select your reporting period (typically the fiscal year under audit, or the quarter being tested)
- Click Download evidence package (PDF) or Export CSV
Audit cadence
SOX ITGC testing typically occurs at two points:
- Interim testing (Q2–Q3): Covers approximately 6 months of activity — run the report for your interim period
- Year-end testing (Q4): Covers the full fiscal year — run the report for the full 12-month window, or combine interim + year-end periods
Koalr's date range selector supports any arbitrary period, so you can produce exactly the window your auditor requests.
External auditor review notes
- The PDF cover page names "External Auditor (PCAOB / Financial Statement Audit)" in the Prepared For field
- Evidence is scoped to GitHub repositories connected to your Koalr organization — ensure all in-scope financial system repositories are connected
- SOX ITGC testing covers the entire audit period; if your organization added repositories mid-year, note the coverage gap in your management representation letter
- Pair Koalr's ITGC evidence with your access provisioning/deprovisioning logs for a complete ITGC package
Integration requirements
- GitHub (required) — provides all change management and access control data
Disclaimer
This report is designed to support SOX ITGC evidence collection for the covered controls. It does not constitute a formal SOX compliance opinion. Engage your external auditor or a SOX-qualified firm for your annual ICFR assessment.
FedRAMP Moderate Evidence Report
NIST SP 800-53 Rev 5 configuration change control evidence for FedRAMP Moderate — CM-3, CM-4, CA-7, and SA-11.
HIPAA Evidence Report
HIPAA Security Rule Technical Safeguards evidence under 45 CFR § 164.312 — audit controls, access authorization, integrity controls, and transmission security.