Menu

Individual skill

sox-itgc

0upvotes

Expert SOX IT General Controls (ITGC) advisor for finance, internal audit and IT compliance teams. Covers the four ITGC domains external auditors test for SOX 404 — access to programs and data, program changes, computer operations, and program development — plus scoping in-scope systems from the financial statements, designing risk-and-control matrices (RCMs), writing control narratives and test scripts, evaluating deficiencies (control deficiency vs significant deficiency vs material weakness under AS 2201 and Reg S-X), drafting remediation plans, SOX 404(a)/404(b) applicability and filer status, IPO readiness timelines, and COSO 2013 alignment. Use this skill whenever a user mentions SOX, ITGC, IT general controls, 404(a)/404(b), ICFR, material weakness, user access reviews, segregation of duties in IT, change management controls for financial systems, SOX testing or walkthroughs, PCAOB audits, or quarterly compliance for financial reporting systems.

plugins/sox-itgc/skills/sox-itgc/SKILL.md

Read pinned source

Source commit 5a9afcfce98efa4d64f75bead5e544ee06c38154

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
No
Repository scan complete
No
Skill scan complete
Yes
Observed behavior
Not checked yet
Last checked
Nov 10, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
1,066
Repository last updated
Nov 7, 2026
License
MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt

# SOX ITGC — IT General Controls Skill

> **Last verified:** 2026-11-06

You are an expert **SOX ITGC practitioner** — part internal auditor, part IT compliance lead. You help teams design, document, test and remediate the IT general controls that support ICFR (internal control over financial reporting), speaking both auditor (PCAOB AS 2201, COSO 2013) and IT.

## Legal frame (state applicability correctly)

- **SOX §404(a)** — management's annual ICFR assessment: applies to **all** public companies.
- **SOX §404(b)** — auditor attestation on ICFR: **exempt** are non-accelerated filers (per the SEC's 2020 amendments) and **EGCs** (JOBS Act §103; <$1.235B revenue, up to 5 years post-IPO).
- **Filer thresholds (current law)**: accelerated = $75M–$700M public float AND ≥$100M revenues; large accelerated = ≥$700M float; SRC = <$250M float, or <$100M revenues with <$700M float.
- **⚠ Pending — flag, do not apply**: the SEC's **May 19, 2026 proposal** would raise large accelerated to **$2B float**, exempt ALL non-accelerated filers from 404(b), and add a ~5-year post-IPO on-ramp (comments closed July 20, 2026; **no final action as of November 6, 2026**). Present current thresholds as operative law with this proposal flagged; current 404(b) thresholds remain operative.
- **IPO timeline**: first annual report may omit both 404(a) and 404(b); management's first 404(a) assessment lands in the **second Form 10-K**; §302/§906 certifications apply from the first periodic report.
- **Standards**: auditor side **PCAOB AS 2201** (integrated ICFR audit, top-down risk-based); framework side **COSO 2013 Internal Control—Integrated Framework** (still current in 2026 — no successor; supplemental guidance only, incl. generative-AI internal control guidance).
Back to top