SOX ITGC

Controls over the systems behind a financial statement are tested every year by an external auditor. An assistant that touches a reporting system joins that test. This starter maps its traffic path and supplies evidence inputs for access, change and approval questions.

An internal audit lead needs to know which controls the tool actually touches, and who signs off. The answer decides whether it becomes a key control or stays outside the scope of testing. This starter keeps that boundary visible.

Separation of duties is the theme. The identity check refuses a call without verified user and organization claims, so no request is anonymous. Taxpayer identification numbers are masked, and prompts that ask for an account export, wire details or credentials are blocked.

Change handling is where this starter earns its place. Approval sits with a person for every request, and the caller receives no generated content in return. A control change, a report release and an incident response all move through that one queue, together with routine questions. The result is the approval trail an auditor asks about.

Answers must reach a combined score of 0.86, relevance of 0.78 and accuracy of 0.80. A single sentence or a reply under 120 characters is rejected. Grounding is measured and flagged rather than blocked, so a reviewer still reads the answer.

Backup verification, job scheduling and program development controls remain owned by your platform teams. Key controls, testing plans and management assertions stay with finance and internal audit. The gateway supplies material for one path and nothing more.