What is SOX ITGC?

Quick answer

SOX ITGC refers to the IT general controls that support Sarbanes-Oxley compliance: the controls over the systems that produce a public company's financial reports. External auditors test them annually because financial data is only as reliable as the systems it flows through. The classic ITGC domains are access to programs and data, program changes, program development, and computer operations, applied to every system in the financial reporting chain: the ERP, billing, revenue systems, and the databases and infrastructure beneath them.

What each domain covers

Access to programs and data: who can touch financially relevant systems: provisioning with approval, timely deprovisioning, periodic access reviews, privileged access restriction, and segregation of duties so no one person can both create and approve a transaction.
Program changes: changes to financial systems follow a controlled path: authorized, tested, approved, and deployed by someone other than the developer, with the trail to prove it.
Program development: new systems entering the financial chain are implemented with integrity: data migrations validated, go-lives approved.
Computer operations: the systems run reliably: job scheduling and monitoring, incident handling, and backups with restoration evidence.

Why ITGC failures hurt

An ITGC deficiency doesn't just generate a management letter comment. Deficiencies aggregate: enough of them, or a severe one (say, developers with unmonitored production access to the ERP), can escalate to a significant deficiency or material weakness, which is publicly disclosed, moves audit fees, and lands on the CFO's desk with force. The recurring root cause is manual control execution: access reviews done in spreadsheets, change approvals reconstructed from email, exactly the failure mode automation removes.

Who owns it

SOX applies to US-listed companies (and their significant subsidiaries, including European ones with US parents), but the ITGC pattern extends further: pre-IPO companies build it 12 to 18 months ahead of listing, and private-equity-owned firms adopt it as exit preparation. IT and engineering own the controls; finance owns the outcome; the platform keeps them aligned.