Home / ERP security / SOX ITGC
SOX ITGC compliance for public companies
IT SOX work for public companies running NetSuite and Coupa: we design, operate and evidence the IT general controls your external auditors test, and fix what they find.
SOX IT general controls (ITGCs) are the controls over the systems that produce a public company's financial statements, tested under Sarbanes-Oxley Section 404. RevSift supports IT SOX compliance for public companies on NetSuite and Coupa: control design and documentation, quarterly control operation, evidence for internal and external auditors, and remediation of deficiencies.
The ITGC domains we cover
| Domain | What it means for NetSuite and Coupa |
|---|---|
| Access to programs and data | User provisioning and termination, role design, privileged and administrator access, segregation of duties, quarterly user access reviews, integration and service accounts |
| Program change management | How configuration changes, SuiteScripts, workflows and integrations are requested, tested in sandbox, approved and deployed, and how unauthorized production changes are detected |
| Computer operations | Monitoring of scheduled scripts and integration jobs, failure handling, and incident tracking |
| Third-party and reliance | Reviewing Oracle NetSuite and Coupa SOC 1 reports, and mapping their complementary user entity controls (CUECs) to your own |
What we do for public companies
Control design & documentation
ITGC narratives, risk and control matrices (RCMs), and control descriptions written to be tested, covering NetSuite, Coupa and their integrations.
Quarterly control operation
User access reviews, privileged access reviews, SoD conflict reports and change-log reviews prepared each quarter for control owners to sign off.
Audit evidence & walkthroughs
Evidence prepared for auditor requests (PBC lists), plus support during walkthroughs with internal audit and the external auditor.
Key reports (IPE)
Validating the completeness and accuracy of the NetSuite saved searches and reports your business controls rely on, and documenting how they're produced.
Deficiency remediation
Root-cause and fix for control deficiencies: role redesign, change-management process, monitoring, and evidence that the fix is operating.
Automated monitoring
Alerts on role and permission changes, new administrators, script deployments and vendor banking changes, so issues surface before the quarter closes.
Why NetSuite expertise matters for IT SOX
Generic IT audit teams often struggle to evidence NetSuite controls: which permissions create SoD conflicts, where to find system notes for a changed script, or how to prove a saved search is complete. We know where that evidence lives in NetSuite and Coupa, so control owners spend less time answering auditor follow-ups. See also ERP security and compliance.
SOX ITGC FAQ
What are ITGCs in SOX?
IT general controls are the controls over access, program changes and computer operations for systems that support financial reporting. Under SOX Section 404, management assesses them and, for many public companies, the external auditor tests them, because automated controls and system reports can only be relied on if the ITGCs around them work.
Is NetSuite SOX compliant?
No system is SOX compliant on its own. Oracle provides SOC 1 reports covering the controls it operates for NetSuite, but each public company must design and operate its own controls over access, changes and operations in its NetSuite account, including the complementary user entity controls listed in the SOC 1 report.
What evidence do auditors ask for on NetSuite ITGCs?
Typically user listings with roles, evidence of quarterly user access reviews, termination evidence, administrator and privileged access listings, change tickets with testing and approval for scripts, workflows and configuration changes, and support for the completeness and accuracy of key reports.
Can you help remediate an ITGC deficiency?
Yes. We identify the root cause, such as excessive access, an untracked change path or a missing review, fix the control in NetSuite or Coupa, and help produce the evidence that the remediated control is operating effectively.
Contact
Tell us what's going on in your NetSuite account
Send a few lines about the problem: what's broken, slow, manual, or missing. You'll hear back from one of the people who would do the work, with questions or a suggested next step.