The controls a build suspends
Program change control and logical access rank first and second among IT weaknesses in Mojtahedi and Zhou's classification of SOX 404 reports filed 2014 through 2018.
Published ITGC guidance describes controls operating in steady state, and an implementation is the period when they do not, which is also when the auditor arrives. This report is written for the enterprise architect who owns the SAP target design and is asked for the audit evidence.
No form, no email required.
What is inside
- The ranking: 31 percent of reports in this collection carried at least one IT weakness, against 21 percent in the earlier research the authors cite.
- What a build suspends: role design runs while users are already testing, emergency access is reviewed by exception, and transports are approved in batches.
- Four practices with no slowdown: the first two are agreeing the evidence with the auditor before the build begins, and tying each transport to its requirement the moment the transport is created.
- The project director's account: six audits during an 18 month, $150 million consolidation of seven ERP systems with SOX controls in force.
- The AI agent section: an agent that makes changes needs its own communication user, roles bound by the same segregation-of-duties rules, and every change recorded on the transport path, with NIST AI 100-1 and ISO/IEC 42001:2023 named as the standards an auditor reaches for.
Sources cited in full inside the document
- International Journal of Accounting Information Systems
- NIST AI 100-1
- ISO/IEC 42001:2023
The research is peer-reviewed and every figure traces to the source named above. The customer account is one program at one company, and the identity is withheld.
No form, no email required.
