If your company is public, preparing to list, or part of a US-listed group, your auditors will ask how IT handles access, changes, backups and evidence. As your managed service provider, we set up those controls in Microsoft 365, Google Workspace and your devices, and keep the evidence ready every quarter.
SOX IT general controls, or ITGC, are the IT part of a financial audit. They are not exotic. They are the discipline of knowing who can touch financial systems, how changes are approved, and whether you could recover if something broke. We make that discipline real in the systems you already run.
We work alongside your finance team and your audit firm. We do not perform the audit, and we do not replace your internal control owners. We make sure IT is never the reason a control fails.
We review your current environment against the ITGC your auditor will test and give you a prioritised list.
We close the gaps, from access cleanup and conditional access to change tracking and backup testing.
Access reviews, change records and backup checks become routine, with evidence produced as a by-product.
We sit with your controller and your auditor, answer the IT questions and supply the evidence in the format they expect.
Auditors like this part. We operate inside your own Microsoft 365, Google Workspace and financial systems through dedicated admin accounts in your company's name, protected by MFA, logged, and used only on your instruction, which is itself a control you can show. Nothing moves to SF3 Technologies' systems.
If the relationship ends, we hand the controls, the evidence and the documentation over to your new team with a documented handover, support the changeover, and then our accounts are removed, so you keep everything.
Companies six to eighteen months from a listing have a short window to get IT controls running through full quarters before auditors test them. We help you start early and start small: identity cleaned up, admin access reduced and logged, change management introduced in a way engineers will actually follow, and backups proven to restore.
Start the conversationIf your parent company is listed in the United States, your IT inherits SOX whether or not anyone in your office has read the law. We work with subsidiaries whose headquarters send a control questionnaire once a year and expect clean answers. We translate those requirements into concrete settings, run the controls locally and report in the format the group expects.
Microsoft 365 managementThe same controls answer most other questions a growing company gets asked: SOC 2 readiness, customer security questionnaires, cyber insurance applications, GDPR obligations in Europe and local data protection laws such as Colombia's Ley 1581. Once the evidence exists, answering becomes a matter of pointing at it.
Email security and DMARCIf yours is not here, ask and a real person will answer.
Ask us something elseAuditors focus on IT general controls: who has access to financial systems, how changes are approved and logged, whether backups and recovery are tested, and whether evidence exists for all of it. For a company of your size the list is manageable once it is written down and run on a schedule.
Start at least a year before the expected listing so that access reviews, change management and logging have run through full quarters by the time auditors test them. Starting earlier makes the work smaller, because clean access and good backups are easier to maintain than to reconstruct.
Yes, we export who has access to what across Microsoft 365, Google Workspace and your financial systems, prepare the review for your control owners to approve, and file the evidence. Changes the review turns up are carried out and recorded the same way.
Start with an IT general controls assessment that documents access, changes and backups as they are today, and compare it with the questionnaire your headquarters sent. We then close the gaps and hand you the evidence in the format your group's auditor expects.
Yes, the same access, change, backup and logging controls answer most of a SOC 2 readiness review and most customer security questionnaires. We prepare the IT answers and the supporting evidence so your team can respond with confidence.
No, your audit firm tests the controls, and we design, implement and operate the IT side so there is something solid for them to test. Keeping those roles separate is part of what makes the controls credible.
An auditor, a board or a parent company asking IT questions you cannot yet answer?
Talk to us