SOX Compliance
ITGCs are the IT half of 404.

SOX directly applies to all publicly traded companies whose securities are registered with the SEC. Functionally, it also applies to pre-IPO companies preparing for an IPO or SPAC merger (typically needing 1-2 years of SOX-ready operations before going public), companies acquired by public companies (where the acquirer must extend SOX coverage), and certain private companies with significant public debt. Foreign private issuers listed on US exchanges are also subject, with some accommodations. Companies under $75M in public float qualify as non-accelerated filers with lighter Section 404(b) external auditor requirements.

ITGCs (IT General Controls) are the controls over the IT environment that support the integrity of application controls in financial systems. The four main domains: Logical Access (who can access what financial systems, how access is granted, reviewed, and removed), Change Management (how changes to financial systems get approved, tested, and deployed), Computer Operations (batch processing, backup, recovery, system monitoring), and Program Development (system implementation and major change controls). External auditors test ITGCs because they support the reliability of application-level controls that protect financial reporting.

External auditors test change management more than any other ITGC area because changes to financial systems carry the highest risk of introducing errors that affect financial reporting. The audit testing covers: approval workflow (changes are approved by appropriate management before deployment), test evidence (changes are tested in non-production environments with documented evidence), production deployment (changes are deployed by someone other than the developer with documented evidence), and segregation of duties (no one person can develop, approve, and deploy changes). Most ITGC findings in audits trace to change management gaps.

SOX is a federal law requiring public companies to maintain ICFR. SOC 1 (SSAE 18) is a third-party attestation report on a service organization's controls relevant to user entities' financial reporting — commonly used by service providers (cloud hosting, payroll, transaction processing) whose customers need to demonstrate SOX-compliant ICFR. SOC 2 is a voluntary attestation against five Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy) — commonly required by enterprise customers and used for marketing security posture. Many organizations need all three.

Pre-IPO companies typically need 1-2 years of SOX-ready operations before the IPO — meaning the ITGC framework needs to be operational, documented, and producing evidence well before the first 10-K is filed. The preparation track includes: ITGC framework design and implementation, change management formalization, access review cadence establishment, evidence collection workflow, external auditor selection and engagement, mock integrated audit readiness assessment, and remediation cycles. Companies that delay SOX preparation until close to the IPO discover the integrated audit cost and timeline materially. WCC's program is sized for the multi-year pre-IPO track.

Pricing depends on company size, audit firm, in-scope systems, and existing maturity. Initial SOX readiness engagement for a mid-sized public company or pre-IPO firm typically runs $40,000-$120,000 as a fixed-fee project covering ITGC framework design, gap assessment, remediation planning, and initial evidence collection. Ongoing SOX program management typically runs $8,000-$25,000 per month for mid-market companies covering access reviews, change management oversight, audit coordination, and quarterly management reporting. Pricing scales materially with the number of in-scope financial systems and the audit firm's expectations.