Home / Blog

Writing on SOX and internal audit workflow

Practical methods first, product mentions second. Written by the practitioner who builds SoxDesk.

• On-premise SOX audit software: why internal audit is quietly moving back on-prem

  Cloud GRC platforms dominate the headlines, but a quiet counter-trend is growing: internal audit teams keeping SOX workpapers on their own infrastructure. Here's why, and what an on-premise setup looks like in 2026.

• PwC Aura alternatives for internal audit teams (2026)

  An honest look at audit workflow options for internal audit and SOX teams in 2026 — AuditBoard, Workiva, TeamMate+, spreadsheets, and on-premise tools — with guidance on which fits which kind of team.

• Stop running SOX testing out of spreadsheets: a migration path

  A practical, low-drama migration path from Excel-based SOX testing to a real workflow tool — what breaks in spreadsheets, what to keep in them, and how to move an RCM without retyping a year of work.

• ITGC scoping from business process walkthroughs: a practical method

  A step-by-step method for deriving your ITGC application scope from business process walkthroughs — IT dependencies, application inventory, coverage mapping, and the two reconciliations that catch scoping gaps before your external auditor does.

• IPE and report reliance in SOX audits: getting IT-dependent controls right

  Most "manual" SOX controls quietly depend on system-generated reports. Here's how to identify IPE, what evidence actually supports report reliance, how ITGCs fit in, and how to keep the whole dependency chain from living in one person's head.

• Segregation of duties between preparer and reviewer: why your workflow tool should enforce it

  Preparer-reviewer segregation is the one control audit teams apply to everyone but themselves. Why initials in a spreadsheet fail, what server-enforced review actually changes, and what to look for in a workflow tool.

• SOX control testing sample sizes: a practical reference

  The frequency-based sample sizes SOX teams actually use — annual through daily and automated controls — plus how to adjust for risk, what to do when you find an exception, and how to document selection so it survives review.

• How to run a SOX roll-forward without redoing the audit file

  A practical guide to rolling a SOX audit file into the new year: what to carry forward, what must reset, the errors that quietly corrupt next year's file, and how to make roll-forward a one-day task instead of a three-week one.