SOX compliance software: Sarbanes Oxley software, SOX compliance tools and internal controls software for the ITGC half of SOX 404

SOX compliance software helps a company document, test and evidence the internal controls over financial reporting required by the Sarbanes-Oxley Act. In practice it does one or both of two jobs: managing the financial-process controls (risk and control matrix, testing workflow, certifications) or managing IT general controls (access, change and operations evidence). Most tools are noticeably stronger at one of the two, so match the tool to the half you are struggling with.

ITGC stands for IT general controls, the controls over the systems that produce financial data rather than over the transactions themselves. They group into three domains: access to programs and data, program change, and computer operations. Auditors test them first because if access and change controls are weak, no application-level control on top of them can be relied on, and the whole testing plan expands.

Section 404(a) is management's own annual assessment of internal control over financial reporting, and it applies to every filer from the second annual report onward. Section 404(b) is a separate attestation on those controls by your external auditor, and it only applies to accelerated and large accelerated filers. 404(b) is the expensive one, which is why filer status is the first thing to establish.

The 404 internal control requirements do not apply to private companies. Two caveats matter. The criminal provisions on document destruction and retaliation against whistleblowers apply to any company. And private companies preparing to go public, or expecting to be acquired by a filer, are routinely asked to demonstrate a SOX-ready control environment well before the first 10-K, which is why pre-IPO teams start early.

Not immediately, but the timing is tighter than it looks. Management's 404(a) report is required from your second annual report, and it has to cover a full period, so the controls need to be operating and evidenced well before the report is written. Companies that wait until after the IPO usually spend the first year reconstructing evidence for controls that were technically in place but never documented.

A workable SOX tool needs to hold the control set with owners and testing frequency, collect or store evidence against each control on a schedule, track deficiencies and remediation to closure, and produce a period record an external auditor can sample. For the ITGC half specifically, it needs integrations with your identity provider, code repository and cloud, otherwise evidence collection stays manual.

Access is the most heavily tested ITGC domain. A SOX program expects provisioning to be approved, access to match the role, privileged access to be restricted and monitored, leavers to be removed promptly, and the whole population to be reviewed periodically by someone accountable. The recurring deliverable is a dated user access review with a named reviewer, which auditors sample directly.

That changes to in-scope systems are authorized, tested and approved by someone other than the developer before reaching production, and that emergency changes get reviewed after the fact. Auditors pick a sample of production changes and ask for the approval that preceded each one. Teams already using pull request reviews usually satisfy this with evidence they are producing anyway.

Only for development that touches systems in financial reporting scope, and then it is the change control around the work rather than the coding itself. The practical requirements are separation between who writes and who approves, an environment split between development and production, restricted production deployment rights, and a record of approvals. Development outside that scope is unaffected.

SOX is US federal law governing internal control over financial reporting at public companies, enforced by the SEC. SOC 2 is a voluntary attestation about security and related criteria that companies obtain because customers ask for it. They are different in purpose but overlap heavily in the IT controls underneath, so access and change evidence collected for one usually serves the other.

It depends which half you need. For a mature program with an internal audit function, Optro (formerly AuditBoard) and Workiva are the established choices, and Pathlock if your risk concentrates in ERP access and segregation of duties. For a pre-IPO or newly public team where ITGC has landed on engineering, Complies covers access reviews, change approvals and operations evidence at a published price. Anyone claiming one tool is best for every filer has not asked what your filer status is.

The enterprise SOX platforms are quote-only, so no honest public number exists for them, and the total is usually driven by modules and user counts negotiated per deal. Complies publishes its full range at $79, $199 and $499 a month. Budget the external audit separately, because for an accelerated filer the 404(b) attestation fee is typically the largest line in the whole program.

Not yet, and not for everyone. The proposal issued on May 19, 2026 would raise the large accelerated filer threshold from $700 million of public float to $2 billion and limit 404(b) attestation to large accelerated filers, which the SEC estimates would exempt about 81 percent of public companies. The comment period closed July 20, 2026 and the rule has not been adopted, so current thresholds still apply and 404(a) is unaffected either way.