SOX ITGC control testing
IT general control testing across access, change and operations for in-scope financial applications.
SOX
19 questions~90 minquarterly
Typically run by Internal Audit / SOX Compliance
Loading AuditFlow…
Finance
Banks, NBFCs, insurers, fintechs, payment processors and capital markets firms.
The job you're hiring this for
Evidencing ITGC and access controls for SOX or an RBI IS Audit, with quarterly access recertification that actually gets completed.
Weighted questions with auditor guidance, and on most of them the clause each question evidences — ready to run, or to edit into your own house standard.
IT general control testing across access, change and operations for in-scope financial applications.
Typically run by Internal Audit / SOX Compliance
Walks the twelve PCI DSS v4.0 requirements against the cardholder data environment, sized for an SAQ-D style review.
Typically run by Security / Compliance Lead
IS audit against the RBI Master Direction on IT Governance, Risk, Controls and Assurance Practices for regulated entities.
Typically run by IS Auditor (CISA/DISA)
Branch-level controls covering cash, KYC documentation, account opening, dormant accounts and physical security.
Typically run by Internal Auditor / Concurrent Auditor
File-level review of customer identification, beneficial ownership, risk categorisation and periodic updation for a sample of accounts.
Typically run by Compliance Officer / Concurrent Auditor
Reviews scenario coverage, data completeness and the quality of alert disposition through to suspicious transaction reporting.
Typically run by AML Compliance / Principal Officer
Tests list currency, rescreening coverage, match quality and the discipline around discounting a potential match.
Typically run by AML / Sanctions Compliance
Credit audit of sanctioned loan files covering appraisal quality, delegated authority, security creation and end use of funds.
Typically run by Credit Audit / Internal Auditor
Tests asset classification against the date of default, borrower-level application, income reversal and provisioning adequacy.
Typically run by Internal Audit / Credit Monitoring
Reviews front, mid and back office separation, limit discipline, deal capture integrity and independent confirmation and valuation.
Typically run by Internal Audit / Market Risk
Tests whether complaints from every channel are captured, resolved substantively within turnaround, and drive systemic fixes.
Typically run by Nodal Officer / Compliance
Reviews whether products sold matched the customer's profile, what was disclosed before sale, and whether incentives cut across suitability.
Typically run by Compliance / Business Assurance
Regulatory governance review of outsourcing arrangements — materiality, approval, contractual rights, concentration and tested exit.
Typically run by Compliance / Vendor Governance
Tests the completeness of the entry population and whether preparation, approval and support hold up on high-risk manual entries.
Typically run by Financial Controller / Internal Audit
Tests the SoD matrix against actual role assignments in the core banking system, including compensating controls at small branches.
Typically run by IS Audit / Internal Audit
Reviews the completeness of the related party register and whether transactions had prior approval, arm's length pricing and correct disclosure.
Typically run by Internal Audit / Company Secretary
Internal audit against Regulation (EU) 2022/2554 — ICT risk management, incident classification and reporting, resilience testing and the ICT third-party chapter.
Typically run by Head of Operational Resilience / Internal Audit
Internal assessment of network security controls, segmentation, data-flow documentation and system hardening against PCI DSS v4.0 Requirements 1 and 2, in the order an assessor samples them.
Typically run by Internal QSA / Network Security Lead
Internal assessment of account data retention, sensitive authentication data, PAN masking and rendering unreadable, key management and transmission encryption against PCI DSS v4.0 Requirements 3 and 4.
Typically run by Internal QSA / Data Protection Lead
Internal assessment of anti-malware coverage, anti-phishing, secure development, vulnerability ranking and patching, payment-page script control and change management against PCI DSS v4.0 Requirements 5 and 6.
Typically run by Internal QSA / Application Security Lead
Internal assessment of need-to-know access, access reviews, unique identification, password and passphrase controls, MFA and application account management against PCI DSS v4.0 Requirements 7 and 8.
Typically run by Internal QSA / Identity and Access Manager
Internal assessment of audit logging, log review, time synchronisation, control-failure detection, wireless detection, vulnerability scanning, penetration testing, intrusion detection and payment-page tamper detection against PCI DSS v4.0 Requirements 10 and 11.
Typically run by Internal QSA / Security Operations Lead
Internal assessment of the security policy, targeted risk analyses, scope confirmation, awareness training, third-party service provider management and incident response against PCI DSS v4.0 Requirement 12.
Typically run by Internal QSA / CISO
Internal audit of DORA requirements around ICT systems and risk sources, awareness training, the simplified framework, incident classification and reporting, resilience testing and TLPT, ICT third-party oversight and threat-intelligence sharing.
Typically run by Head of ICT Risk / Internal Audit
Review of the parts of a Sarbanes-Oxley ICFR programme that sit above individual process controls — COSO 2013 mapping, scoping, deficiency evaluation, s.302 and s.404(a) — plus the IT and reporting controls auditors most often find missing: IPE, spreadsheets, SOC 1 reliance, direct data changes, service accounts and system conversions.
Typically run by SOX PMO / Internal Audit
Review of the governance structure and assurance expectations in the RBI Master Direction on IT Governance, Risk, Controls and Assurance Practices — Board, IT Strategy and Steering committees, Head of IT, asset inventory, logs, cryptography, physical controls, IS risk, DR drills, third parties and data migration.
Typically run by IS Auditor / CISO Office
Each of these has a real control library in the product — questions map to specific clauses, so gap analysis shows you what is genuinely unevidenced.
Card-brand mandated controls for anyone storing, processing or transmitting card data.
248 controls mapped
The international standard for information security management systems.
118 controls mapped
Business continuity management — impact analysis, strategies and tested plans.
31 controls mapped
Internal control over financial reporting for US-listed companies and their subsidiaries.
32 controls mapped
Reserve Bank of India requirements for IT governance, cyber resilience and outsourcing.
27 controls mapped
India's personal data protection law, with consent and breach-notice obligations.
39 controls mapped
EU privacy regulation applying to any organisation processing EU residents' data.
61 controls mapped
Not hypotheticals. These are the findings that recur in financial services, and every one of them is a question in at least one of the 26 templates above.
Templates, findings and AI prompts use your sector's terms, not generic audit language.
Pick one of the 26 templates above, walk the site with your phone, and see the finished report before you get back to your desk.