SOX IT General Controls: A Checklist for Your Web and Finance Systems
By the Netsam team · · 5 min read
Quick answer
SOX IT general controls cover how systems that touch financial reporting are changed, accessed and operated. For web systems, portals and integrations, that means separate environments, approved promotion to production, separation of duties, least-privilege access with periodic reviews, documented integrations and logs that show who did what and when. Your auditors judge the controls; Netsam builds systems that produce the evidence.
What are SOX IT general controls, in plain terms?
IT general controls (ITGCs) are the rules around the systems your financial numbers pass through. Auditors want to know that nobody can change those systems, or the data in them, without a record and an approval. If the controls around a system are weak, the reports that system produces are harder to rely on.
Most finance leaders think of the ERP and the general ledger first. But client portals, reporting tools, reconciliation scripts and the integrations that feed the ledger are often in scope too. These are the systems most likely to have grown up informally, built by whoever was available and changed whenever someone asked.
Netsam builds and runs web systems for financial organizations with these controls designed in from the start. SOX compliance itself belongs to your organization and its auditors. What a technology partner can do is provide the controls, evidence and documentation your program relies on.
Which controls should every finance-facing system support?
Use this list when you review an existing system or evaluate a vendor. Each item should be something the system or its operating process does every day, not something assembled the week before fieldwork.
- Separate environments. Development, staging and production exist as distinct environments, provisioned the same way.
- Approved promotion. Code and configuration reach production only when a named approver releases them.
- Change records. Every change is logged with who proposed it, who approved it and when it shipped.
- Separation of duties. The people who build a change are not the people who release it.
- Least-privilege access. Users and administrators get only the roles their jobs need, and access is reviewed on a schedule.
- Documented integrations. Every connection into a financial system has an owner, a written specification and a fallback.
- Scheduled reconciliation. Exception and reconciliation reports run on a schedule, and someone signs off on them.
Where do controls usually break down?
In our experience the gaps are rarely dramatic. They are small habits that made sense at the time. A developer fixes a bug directly in production because the month-end close is tomorrow. A former contractor still has an admin login. An integration into the ledger runs from a server under someone's desk, and only one person knows how it works.
The other common gap is evidence. Teams often do the right things but cannot prove it quickly. When auditors ask for a sample of changes with approvals, someone spends days pulling email threads and ticket history together. That effort is a sign the control lives in people's memory rather than in the system.
- Hotfixes applied directly to production with no ticket
- Shared administrator accounts with no individual attribution
- Access lists that are never reviewed after someone changes roles
- Undocumented integrations owned by whoever built them
- Reports assembled by hand from systems that do not join
How does Netsam build these controls into a system?
We treat governance as part of the infrastructure, not a policy layered on top. On our hosting and managed infrastructure, environments are provisioned identically, promotion paths and rollback are built in, and the release pipeline records the proposer, the approver and the timestamp automatically. Separation of duties is enforced by roles in the pipeline, so the person who wrote a change cannot also push it live.
We apply the same discipline to automation. When AI drafts a reconciliation note or flags an exception, a named person reviews, edits or rejects it before anything is written back, and that decision is logged. Our phrase for it is simple: AI drafts, humans apply judgment, systems scale with confidence.
The result is evidence that already exists. When an auditor asks for change history or an access review, you export it instead of rebuilding it.
What should you ask a vendor before you sign?
Whether you are a bank, a credit union, a wealth firm or a public-company finance team, a few direct questions will tell you whether a vendor takes controls seriously. Ask them to show you, not tell you.
Ask to see a real change record from their release process. Ask who on their team can push to production and who cannot. Ask how they handle an emergency fix during close. Ask how often access is reviewed and what the output looks like. A partner that builds for regulated work will have ready answers and sample artifacts.
Netsam is based in Arlington, Texas, and work with finance teams across the Southwest and nationwide. If you want a second set of eyes on the controls around your portals, reports or ledger integrations, discuss your project with us or call 866-294-3489.
Frequently asked questions
Does Netsam make our systems SOX compliant?
No technology vendor can make an organization SOX compliant. Compliance belongs to your company, your management and your auditors. We design, build and operate systems that support SOX IT general controls, including separate environments, approved promotion, separation of duties, access reviews and logged changes, and we provide the documentation and evidence your control program relies on.
Are client portals and integrations in scope for ITGCs?
They can be. If a portal, reporting tool or integration creates, changes or moves data that ends up in financial reporting, your auditors may consider it in scope. The safest approach is to inventory every system that touches the ledger and apply the same change control and access discipline to each one, rather than guessing which ones will be sampled.
How do emergency fixes work under change control?
A good process allows urgent fixes without skipping the record. The fix still goes through the pipeline, still has a named approver and is still logged, often with a faster review path and a follow-up review afterward. What it should never do is bypass the pipeline by editing production directly, because that leaves no reliable evidence of what changed.
Does Netsam work with finance teams outside Dallas–Fort Worth?
Yes. We are headquartered in the Dallas–Fort Worth area and work with organizations across Texas and the Southwest, including Austin, Houston, San Antonio, Oklahoma and Louisiana, as well as clients nationwide. Discovery, design reviews and approvals work well remotely, and we host and operate systems for clients wherever they are located.
Related: Finance