SOX ITGC control testing
IT general control testing across access, change and operations for in-scope financial applications.
SOX
19 questions~90 minquarterly
Typically run by Internal Audit / SOX Compliance
Loading AuditFlow…
Finance
Banks, NBFCs, insurers, fintechs, payment processors and capital markets firms.
The job you're hiring this for
Evidencing ITGC and access controls for SOX or an RBI IS Audit, with quarterly access recertification that actually gets completed.
Field inspectors walk the site on iOS or Android. No WiFi or cellular network needed in basements or remote facilities.
Camera images capture device metadata, GPS coordinates, and timestamp signatures to eliminate retrofitted audit logs.
Any failed checklist item automatically opens a corrective action ticket with an assigned owner, countdown SLA, and reminder trail.
Complete evidence package compiles in seconds into a verifiable PDF report ready for visiting auditors or certification bodies.
Access recertification completed as a bulk approval with no evidence of review
Privileged firecall account shared between two administrators
Emergency change approved retrospectively with no post-implementation review
KYC file missing the re-KYC due on a periodic review date
Weighted questions with auditor guidance, and on most of them the clause each question evidences — ready to run, or to edit into your own house standard.
How many you can install depends on your plan: Essentials installs 3, Starter 25, and higher plans have no template limit.
IT general control testing across access, change and operations for in-scope financial applications.
Typically run by Internal Audit / SOX Compliance
Walks the twelve PCI DSS v4.0 requirements against the cardholder data environment, sized for an SAQ-D style review.
Typically run by Security / Compliance Lead
IS audit against the RBI Master Direction on IT Governance, Risk, Controls and Assurance Practices for regulated entities.
Typically run by IS Auditor (CISA/DISA)
Branch-level controls covering cash, KYC documentation, account opening, dormant accounts and physical security.
Typically run by Internal Auditor / Concurrent Auditor
File-level review of customer identification, beneficial ownership, risk categorisation and periodic updation for a sample of accounts.
Typically run by Compliance Officer / Concurrent Auditor
Reviews scenario coverage, data completeness and the quality of alert disposition through to suspicious transaction reporting.
Typically run by AML Compliance / Principal Officer
Tests list currency, rescreening coverage, match quality and the discipline around discounting a potential match.
Typically run by AML / Sanctions Compliance
Credit audit of sanctioned loan files covering appraisal quality, delegated authority, security creation and end use of funds.
Typically run by Credit Audit / Internal Auditor
Tests asset classification against the date of default, borrower-level application, income reversal and provisioning adequacy.
Typically run by Internal Audit / Credit Monitoring
Reviews front, mid and back office separation, limit discipline, deal capture integrity and independent confirmation and valuation.
Typically run by Internal Audit / Market Risk
Tests whether complaints from every channel are captured, resolved substantively within turnaround, and drive systemic fixes.
Typically run by Nodal Officer / Compliance
Reviews whether products sold matched the customer's profile, what was disclosed before sale, and whether incentives cut across suitability.
Typically run by Compliance / Business Assurance
Regulatory governance review of outsourcing arrangements — materiality, approval, contractual rights, concentration and tested exit.
Typically run by Compliance / Vendor Governance
Tests the completeness of the entry population and whether preparation, approval and support hold up on high-risk manual entries.
Typically run by Financial Controller / Internal Audit
Tests the SoD matrix against actual role assignments in the core banking system, including compensating controls at small branches.
Typically run by IS Audit / Internal Audit
Reviews the completeness of the related party register and whether transactions had prior approval, arm's length pricing and correct disclosure.
Typically run by Internal Audit / Company Secretary
Internal audit against Regulation (EU) 2022/2554 — ICT risk management, incident classification and reporting, resilience testing and the ICT third-party chapter.
Typically run by Head of Operational Resilience / Internal Audit
Internal assessment of network security controls, segmentation, data-flow documentation and system hardening against PCI DSS v4.0 Requirements 1 and 2, in the order an assessor samples them.
Typically run by Internal QSA / Network Security Lead
Internal assessment of account data retention, sensitive authentication data, PAN masking and rendering unreadable, key management and transmission encryption against PCI DSS v4.0 Requirements 3 and 4.
Typically run by Internal QSA / Data Protection Lead
Internal assessment of anti-malware coverage, anti-phishing, secure development, vulnerability ranking and patching, payment-page script control and change management against PCI DSS v4.0 Requirements 5 and 6.
Typically run by Internal QSA / Application Security Lead
Internal assessment of need-to-know access, access reviews, unique identification, password and passphrase controls, MFA and application account management against PCI DSS v4.0 Requirements 7 and 8.
Typically run by Internal QSA / Identity and Access Manager
Internal assessment of audit logging, log review, time synchronisation, control-failure detection, wireless detection, vulnerability scanning, penetration testing, intrusion detection and payment-page tamper detection against PCI DSS v4.0 Requirements 10 and 11.
Typically run by Internal QSA / Security Operations Lead
Internal assessment of the security policy, targeted risk analyses, scope confirmation, awareness training, third-party service provider management and incident response against PCI DSS v4.0 Requirement 12.
Typically run by Internal QSA / CISO
Internal audit of DORA requirements around ICT systems and risk sources, awareness training, the simplified framework, incident classification and reporting, resilience testing and TLPT, ICT third-party oversight and threat-intelligence sharing.
Typically run by Head of ICT Risk / Internal Audit
Review of the parts of a Sarbanes-Oxley ICFR programme that sit above individual process controls — COSO 2013 mapping, scoping, deficiency evaluation, s.302 and s.404(a) — plus the IT and reporting controls auditors most often find missing: IPE, spreadsheets, SOC 1 reliance, direct data changes, service accounts and system conversions.
Typically run by SOX PMO / Internal Audit
Review of the governance structure and assurance expectations in the RBI Master Direction on IT Governance, Risk, Controls and Assurance Practices — Board, IT Strategy and Steering committees, Head of IT, asset inventory, logs, cryptography, physical controls, IS risk, DR drills, third parties and data migration.
Typically run by IS Auditor / CISO Office
Walkthrough and sample test of the purchase-to-payment cycle: vendor master changes, approval within delegation, three-way match, duplicate checks, payment release, segregation of duties and reconciliations.
Typically run by Internal Auditor / Finance Controller
Walkthrough and sample test of the order-to-cash cycle: credit approval, pricing and discounts, revenue cut-off, dispatch-to-invoice completeness, credit notes, cash application, receivables reconciliation and provisioning.
Typically run by Internal Auditor / Finance Controller
Comprehensive operational resilience inspection of critical ICT third-party service providers, cloud concentration risks, and mandatory contractual clauses under EU Regulation 2022/2554 (DORA).
Typically run by ICT Risk Manager / Head of Compliance
Strict financial reporting internal controls audit covering access management, segregation of duties (SoD), software change promotion, and job scheduling under Sarbanes-Oxley Act Section 404.
Typically run by Internal Financial Controls Auditor / ITGC Compliance Specialist
Mandatory Reserve Bank of India (RBI) IT governance compliance audit covering board IT strategy committees, CISO independence, cyber crisis management plans (CCMP), and outsourced vendor controls.
Typically run by Chief Information Security Officer / Certified Information Systems Auditor (CISA)
Rigorous resilience audit evaluating Business Impact Analysis (BIA), Maximum Tolerable Downtime (MTD), data center failover drills, crisis communications, and alternate site operations under ISO 22301:2019.
Typically run by Business Continuity Director / Enterprise Resilience Auditor
Comprehensive technical audit covering SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF) for Stock Brokers, Depository Participants, Qualified Stock Brokers, and Trading Intermediaries.
Typically run by CISO / Head of Tech Audit / CERT-In Empaneled Auditor
Technical audit of AWS cloud infrastructure, landing zones, VPC isolation, IAM policies, and KMS encryption aligned with CIS AWS Foundations Benchmark and BFSI regulatory guidelines.
Typically run by Cloud Security Architect / Tech Audit Lead
In-depth operational application security walkthrough for brokerage portals, mobile trading APIs, and order routing systems against OWASP Top 10 vulnerabilities.
Typically run by Application Security Auditor / DevSecOps Lead
Specialized technical audit of electronic trading systems, algorithmic risk filters, order throttling, exchange leased line connectivity, and colocation infrastructure.
Typically run by Capital Markets Tech Auditor / Head of Trading Infrastructure
Enterprise risk-control matrix walkthrough covering ITGCs, financial reporting controls, data integrity, and operational process analysis rather than static checkboxes.
Typically run by Internal Audit Director / Tech Risk Lead
Comprehensive technical audit assessing cybersecurity, data localization, regulatory compliance, and business continuity across third-party FinTech vendors and SaaS providers.
Typically run by Vendor Risk Manager / Third-Party Cyber Risk Lead
Real-time concurrent internal audit and Continuous Controls Monitoring (CCM) reviewing high-value disbursement vouching, daily cash and bank reconciliations, credit facility sanction term compliance, real-time KYC/AML exception screening, and interest/pricing overrides.
Typically run by Concurrent Auditor / Continuous Assurance Manager
Each of these has a real control library in the product — questions map to specific clauses, so gap analysis shows you what is genuinely unevidenced.
Card-brand mandated controls for anyone storing, processing or transmitting card data.
248 controls in its library
The international standard for information security management systems.
118 controls in its library
Business continuity management — impact analysis, strategies and tested plans.
31 controls in its library
Internal control over financial reporting for US-listed companies and their subsidiaries.
32 controls in its library
Reserve Bank of India requirements for IT governance, cyber resilience and outsourcing.
27 controls in its library
India's personal data protection law, with consent and breach-notice obligations.
39 controls in its library
EU privacy regulation applying to any organisation processing EU residents' data.
61 controls in its library
Not hypotheticals. These are the findings that recur in financial services, and every one of them is a question in at least one of the 39 templates above.
Templates, findings and AI prompts use your sector's terms, not generic audit language.
Pick one of the templates above, walk the site with your phone, and see the finished report before you get back to your desk.