SOX ITGC Control Assurance Lab

At a Glance

Frameworks and data sources: SOX 404 ITGC, ICFR, NIST CSF 2.0, ISO 27001, GDPR/PII mapping, CISA Known Exploited Vulnerabilities.

Technologies: Python, SQLite, SQL views, Grafana, pytest, Docker Compose, Markdown evidence reports, deterministic rules, and lightweight z-score anomaly detection.

This project is a simulated SOX ITGC control assurance environment. It models common IT general controls for financial systems, including access management, privileged access review, change management, production deployment approval, backup monitoring, logging, segregation of duties, and remediation tracking. The goal is to show how control objectives can be translated into testable data models, evidence artifacts, control-health metrics, simple anomaly detection, public threat-intelligence enrichment, and management dashboards.

This is not real client audit work and does not claim SOX compliance. It is a reusable lab for experimenting with SOX-style ITGC evidence workflows and security-governance reporting.

Why This Exists

Most company SOX, audit, security, and governance datasets are protected by intellectual-property restrictions, confidentiality obligations, and NDAs. Access approvals, privileged-access reviews, deployment records, audit walkthrough evidence, deficiency logs, and remediation records are usually internal systems of record that cannot be published.

This project provides a representative substitute: simulated ITGC evidence, public .gov vulnerability intelligence, deterministic compliance checks, simple machine-learning-style anomaly detection, and Grafana visualization. The same pattern can be adapted to internal datasets when appropriate permissions and data-handling controls exist.

The lab is designed around the workflow used in IT audit and security governance:

risk -> control objective -> control activity -> evidence -> test -> exception -> deficiency -> remediation -> retest -> reporting

The current implementation focuses on SOX ITGCs with NIST CSF and ISO 27001 mappings. Other control frameworks can be added by extending the control_framework_mappings table and adding new dashboard views.

What It Demonstrates

• SOX ITGC control design and operating effectiveness testing
• ICFR-oriented evidence collection for access, change, operations, logging, and segregation of duties
• Control exceptions, deficiency classification, root cause capture, remediation ownership, and retesting
• Dashboard-ready metrics for control health, SOX readiness simulation, and overdue remediation
• Public threat-intelligence enrichment using the CISA Known Exploited Vulnerabilities catalog
• Supplemental anomaly detection for access and deployment events
• A documented risk model, ontology, and framework mapping across SOX, NIST CSF, ISO 27001, GDPR, PCI, and PII governance concerns

Risk Model and Ontology

This lab uses a security-governance model rather than a pure checklist model. The primary risk is that weak IT general controls over systems supporting internal control over financial reporting, or ICFR, could create a material weakness, significant deficiency, or control deficiency.

The scoring model is intentionally transparent:

risk_score = inherent_risk * control_criticality * observed_failure_rate
readiness_score = weighted_average(control_pass_rate by control_criticality)

Definitions used in the project:

Term	Definition
Asset	Financial-reporting application, identity, job, deployment, log, or evidence record in scope
Threat event	Unauthorized access, unauthorized change, missing log, failed job, or segregation-of-duties conflict
Vulnerability/control gap	Missing approval, stale review, delayed deprovisioning, weak workflow enforcement, or incomplete evidence
Inherent risk	Risk before considering the tested control, estimated on a 1-5 ordinal scale
Control criticality	Relative importance of the control to ICFR reliability, estimated on a 1-5 ordinal scale
Observed failure rate	Failed test items divided by tested population or sample
Residual concern	Remaining risk signal after control testing, represented here by exceptions and open findings
Deficiency	A control failure requiring investigation, severity classification, remediation, and retest

This is a control-health screening model. It is not a legal SOX compliance conclusion, audit opinion, FAIR quantitative loss model, or management materiality determination.

Framework Alignment

SOX analysis in this repo is centered on ICFR reliability. NIST CSF and ISO 27001 are used as security-governance overlays:

SOX ITGC Domain	SOX/ICFR Purpose	NIST CSF Alignment	ISO 27001 Alignment
Access management	Ensure only authorized users can affect financial systems	Govern, Protect: identity management and access control	Access control, identity lifecycle, privileged access
Change management	Prevent unauthorized or untested production changes	Govern, Protect: platform security and change governance	Secure change management and change control
Operations	Support reliable processing, backups, and job monitoring	Protect, Detect: monitoring and resilience	Operations security, backup, monitoring
Logging	Preserve audit trails for privileged and financial-system activity	Detect: continuous monitoring	Logging, monitoring, event evidence
Remediation	Track deficiencies through corrective action and retest	Respond, Govern: improvement and risk treatment	Corrective action and continual improvement

GDPR is related but not identical. SOX asks whether controls support reliable financial reporting. GDPR asks whether personal data is processed lawfully, fairly, transparently, securely, and with data-subject rights in mind. This lab includes PII-aware fields and GDPR mapping, but deeper GDPR parity is listed as future work.

Quick Start

Requirements: Python 3.10 or newer.

python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt
python3 src/generate_data.py
python3 src/run_control_tests.py
python3 src/export_evidence.py
python3 src/generate_report.py
PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 python3 -m pytest

Generated outputs:

• SQLite database: data/simulated_enterprise.db
• Evidence packets: evidence/2026-Q1/
• Markdown report: reports/sox_itgc_readiness_report.md

You can also run the full pipeline with:

make generate
make test

To enrich the simulation with public .gov threat intelligence:

make public-data

The public-data path currently downloads the CISA Known Exploited Vulnerabilities catalog and maps selected exploited-vulnerability exposure records to the simulated application inventory. This does not replace SOX evidence; it adds security context for prioritizing SOX-relevant remediation and future anomaly detection.

To compare deterministic SOX rules with a lightweight anomaly detector:

make anomaly

The anomaly detector uses simple statistical scoring over access and deployment features. It is intentionally supplemental: rule results remain the auditable SOX evidence, while anomaly flags help prioritize investigation and illustrate how a security team could add continuous monitoring.

Control Library

Control ID	Domain	Objective
ITGC-AC-001	Access	New financial-system access is approved before provisioning
ITGC-AC-002	Access	Privileged access is reviewed periodically
ITGC-AC-003	Access	Terminated users lose access promptly
ITGC-CM-001	Change	Production changes are approved before deployment
ITGC-CM-002	Change	Code changes are independently reviewed
ITGC-CM-003	Change	Emergency changes are retrospectively reviewed
ITGC-OP-001	Operations	Critical backups complete successfully
ITGC-OP-002	Operations	Failed jobs are investigated
ITGC-LOG-001	Logging	Privileged actions on financial systems are logged
ITGC-SOD-001	Segregation	Developers cannot approve or deploy their own production changes

Repo Structure

docs/          methodology, control library, data dictionary, walkthrough, remediation playbook
src/           data generation, control testing, risk scoring, evidence export, report generation
sql/           schema, views, and sample audit queries
data/          generated SQLite database
dashboards/    Grafana dashboard JSON
evidence/      generated audit evidence packets
reports/       generated SOX ITGC readiness report
tests/         pytest coverage for representative controls