> ## Documentation Index
> Fetch the complete documentation index at: https://help.dsalta.com/llms.txt
> Use this file to discover all available pages before exploring further.

# US SOX

> Meet Sarbanes-Oxley requirements for internal control over financial reporting.

> Meet Sarbanes-Oxley requirements for internal control over financial reporting.

The Sarbanes-Oxley Act (SOX) is a US federal law that sets requirements for public company financial reporting and internal controls. Sections 302 and 404 require management to assess and certify the effectiveness of internal control over financial reporting (ICFR), with IT general controls (ITGCs) playing a central role.

<Note>
  SOX applies to publicly traded companies in the US and the controls supporting their financial reporting systems.
</Note>

## Who needs US SOX?

<CardGroup cols={2}>
  <Card title="Public companies" icon="building-columns">
    US-listed companies subject to SEC reporting requirements.
  </Card>

  <Card title="Pre-IPO companies" icon="rocket">
    Organizations preparing for an IPO that need SOX-ready controls.
  </Card>
</CardGroup>

## Key components

<CardGroup cols={3}>
  <Card title="ITGCs" icon="server">
    IT general controls over access, change management, and operations.
  </Card>

  <Card title="Section 302" icon="signature">
    Management certification of financial reports each quarter.
  </Card>

  <Card title="Section 404" icon="clipboard-check">
    Annual assessment of internal control over financial reporting.
  </Card>

  <Card title="Segregation of duties" icon="users-gear">
    Prevent conflicts by separating incompatible responsibilities.
  </Card>
</CardGroup>

## How DSALTA helps with US SOX

<Steps>
  <Step title="Activate US SOX">
    Select US SOX from the Frameworks page. DSALTA maps ITGCs to controls.
  </Step>

  <Step title="Review ITGCs">
    Review access, change management, and operations controls and assign owners.
  </Step>

  <Step title="Collect evidence automatically">
    Connect integrations to gather ITGC evidence continuously.
  </Step>

  <Step title="Approve policies">
    Review and approve IT and financial control policies.
  </Step>

  <Step title="Prepare for audit">
    Share ITGC evidence with your external auditors.
  </Step>
</Steps>

## Frequently asked questions

<AccordionGroup>
  <Accordion title="What are ITGCs?" icon="server">
    IT general controls are the foundational controls over your IT environment — access management, change management, and operations — that support reliable financial reporting.
  </Accordion>

  <Accordion title="Does SOX require a specific framework?" icon="scale-balanced">
    SOX does not mandate one, but COSO is the most widely used framework for the underlying internal control assessment.
  </Accordion>
</AccordionGroup>

## Related pages

* [Active Frameworks](/guides/compliance/frameworks-active)
* [Available Frameworks](/guides/compliance/frameworks-available)
* [Controls](/guides/compliance/controls)
* [Audits](/guides/compliance/audits)