Do we need SOX if we are exempt from 404(b)?

Yes. SOX 302 certifications start with your first report and management's 404(a) assessment follows. Your financial statement auditor will also look at IT controls. Only the auditor's separate attestation under 404(b) is deferred.

Which IT systems are in scope for SOX?

Only the systems that create, store or process financial data: accounting and ERP, payroll, banking and expense tools, the identity platform that controls access to them, and where finance files live. Marketing tools and most engineering systems are usually out of scope.

Can our managed service provider also test the controls?

It should not be the formal tester of controls it runs. The provider can do a readiness dry run, but the testing behind management's assessment should come from someone independent, such as your controller or an internal audit firm.

What licences do we need in Microsoft 365?

Business Premium covers MFA, conditional access and device management. Privileged Identity Management and access reviews need Entra ID P2, from Microsoft 365 E5 or an add-on. Plan for audit logs that cover a full year.

GuidesGuides · SOX and compliance

SOX IT controls for pre-IPO companies: a readiness checklist

What auditors test on the IT side, when each part of SOX starts, and the checklist we use to get access, change, backup and logging controls running before the first audit.

9 minute readUpdated October 24, 2026

The short answer

If you plan to list in the next 12 to 18 months, start on your IT general controls now. Auditors want to see access, change, backup and logging controls working over several quarters, not set up the month before they arrive. Most companies of 5 to 150 people can get there with the Microsoft 365 or Google Workspace they already run, a few licence upgrades and a handful of written processes that people actually follow.

What SOX asks of IT, in plain words

The Sarbanes-Oxley Act (SOX) is about one thing: financial reports that investors can trust. IT is in scope only where systems create, store or change the numbers. That makes the IT part narrower than most people fear.

Section	What it means	When it starts for a newly listed company
SOX 302	The CEO and CFO personally certify each quarterly and annual report, and the disclosure controls behind it.	From the first quarterly or annual report after listing.
SOX 404(a)	Management assesses internal control over financial reporting (ICFR) every year, usually against the COSO 2013 framework.	Usually from the second annual report after listing.
SOX 404(b)	The external auditor tests and attests to those controls.	Only for larger filers. Emerging growth companies are exempt for up to five years, and non-accelerated filers are exempt.

Even if your company is exempt from 404(b) for a while, your financial statement auditor still looks at IT controls, and weaknesses found during IPO preparation can end up disclosed in the registration statement. So the evidence has to be audit-grade from the start.

When to start

Time before listing	What should happen on the IT side
18 to 12 months	Confirm your listing timeline and filer status with your counsel and audit firm. List every system that touches the numbers and who owns it. Clean up identity: named accounts, multi-factor authentication (MFA) everywhere, fewer admins.
12 to 6 months	Write the policies and processes. Start running the controls: access reviews, change records, backup restore tests. Collect evidence as you go.
6 months to listing	Run a dry-run walkthrough of every control the way an auditor would. Fix the gaps. Keep the controls running every quarter.
After listing	SOX 302 certifications start with the first report. Keep the evidence calendar going so management's first 404(a) assessment is a matter of pulling files, not rebuilding them.

Which systems are in scope

Not everything. Scope is the systems that create, store or process financial data:

Accounting or ERP: QuickBooks Online, NetSuite, Sage Intacct, Xero and similar
Payroll and HR: ADP, Gusto, Paylocity, Rippling and similar
Banking, payment and expense tools
The identity platform that controls access to all of the above: Microsoft Entra ID or Google Workspace, with MFA and single sign-on (SSO)
Where finance files and spreadsheets live: SharePoint, OneDrive, Teams or Google Drive
The computers your finance team uses

For cloud services you do not run yourself, auditors rely on the vendor's SOC 1 Type II report. Collect those every year and check the "complementary user entity controls" section. It lists what the vendor expects you to do on your side, which is usually access reviews and MFA.

The readiness checklist

These are the IT general controls (ITGC) auditors test, grouped the way they test them.

Access management

A written joiner, mover and leaver process, with access approved before it is granted
Leavers disabled promptly, with HR dates you can compare against disable dates
Quarterly user access reviews of every financial system, signed off by the system owner
Separate, named admin accounts. No shared logins and no admin rights on everyday accounts
Admin roles kept to a few people, with admin activity logged and reviewed every quarter

Logical security

MFA on every account, with phishing-resistant methods such as passkeys for admins
Legacy sign-in methods blocked
Conditional access rules or equivalent sign-in policies, documented
Company computers enrolled in device management (Intune for Windows, Mosyle or another MDM solution for Mac)

Change management

Changes to financial systems and security settings requested, approved, tested and logged
The person who requests a change is never the person who approves it
Configuration change history kept for your accounting system

IT operations and backup

Backups of Microsoft 365 or Google Workspace and your financial data, with failures followed up
A restore test every quarter, with a written record
Incidents logged, investigated and closed

Logging and evidence

Sign-in, admin and file access logs kept for at least the full audit year
Evidence collected on a calendar (monthly, quarterly, yearly), not gathered in audit week
Policies signed, dated and reviewed once a year

Segregation of duties, IT side

IT admins hold no transactional roles in financial systems
Your IT provider cannot approve its own access or its own changes
An executive sponsor reviews and signs off the provider's admin activity

If you run Microsoft 365 or Google Workspace

In Microsoft 365, the two features that help most are Privileged Identity Management (PIM), which makes admin rights temporary and logged, and access reviews. Both need Microsoft Entra ID P2, which comes with Microsoft 365 E5 or can be added to Business Premium. Standard audit logs are kept for 180 days, which is shorter than an audit year, so either license longer retention or export the logs every month to a place your auditor can read.

In Google Workspace, use separate super admin accounts, enforce 2-Step Verification, and check how long your edition keeps admin and login logs. If it is less than a year, export them on a schedule.

Five mistakes we see often

Starting in the audit year. Controls need time to run before anyone can test them.
One shared admin account. If nobody can tell who made a change, the change control fails.
Access reviews without proof. A review that happened but was not signed and dated did not happen, as far as the auditor is concerned.
The IT provider approving its own work. Someone at the company has to approve and review what the provider does.
Forgetting the vendors. A missing SOC 1 report for your payroll provider is a finding, even if your own controls are perfect.

Who does what

SOX is a team effort, and the lines matter:

Your finance team owns the business process controls: revenue, the financial close, journal entries, who can create vendors and release payments.
Your IT provider sets up and runs the IT general controls and produces the evidence.
Someone independent of the person running a control does the testing that supports management's assessment: your controller, an outsourced internal audit firm or a SOX consultant.

Keeping these roles separate is itself something auditors look for.

FAQ

Questions people ask

Short answers to what founders and finance leads ask us most.

Ask us something else

Twelve to eighteen months before listing is comfortable. Controls have to run for several quarters before they can be tested, and identity cleanup alone can take a few months in a company that grew quickly.

How SF3 Technologies helps

We set up and run the IT side of SOX for public and pre-IPO companies: a gap assessment against the controls your auditor will test, remediation in Microsoft 365, Google Workspace and your devices, the controls run every quarter with evidence, and support during audit fieldwork. We work inside your own tenant through dedicated admin accounts in your company's name, protected by MFA and logged, which is itself a control you can show your auditor.

Start with a gap assessment SOX and compliance readiness

This guide is general information, not legal or audit advice. Confirm your filer status, timeline and scope with your securities counsel and your audit firm.