SOX user access controls decide who can log in to the systems behind your financial reporting, and what they can do once inside. This article is the tester's view: how to test joiner, leaver, privileged and review controls. For running the review itself, use our separate guide.
Last reviewed: 17 October 2026. Facts checked. We opened the SEC's 2007 interpretive guidance (Release 33-8810, govinfo.gov; first 100,000 of about 161,000 characters read), which says management should evaluate the IT general controls that other controls depend on. We searched for access control testing guidance but did not open a Big Four technical page or the PCAOB standard (403 error). The test steps below are practitioner method.
SOX applies to companies subject to US securities law. Indian companies are covered only where they are SEC registrants or part of a group that is.
How this differs from the review guide
Our user access review guide explains how to run a review and keep its evidence. This article covers what testers do with the whole access cycle. The review is one of four controls. If joiner and leaver controls are weak, the review has to catch everything, and it rarely does.
For the wider ITGC picture, see the SOX ITGC testing guide.
Scope first
Test access for in-scope applications, the databases under them, and the operating system or cloud layer where it matters. The SEC guidance limits the IT evaluation to controls other controls rely on, so start from your key controls and work back to the systems.
Control 1: Provisioning (joiners and movers)
Risk: someone gets access they should not have, or keeps access after a role change.
| Test step | What you look for |
|---|---|
| Get the population of new users in the period from the system | Not a list from HR alone |
| Select a sample | Per your sampling method |
| Check the request | A request from the right person |
| Check approval | Approved by the data or process owner before access was given |
| Check access given | Matches the approved role, nothing extra |
| Check movers | Old access removed on transfer |
The population should come from the system's user table with creation dates. If you accept a list from the process owner, test it as IPE.
Control 2: Termination (leavers)
Risk: a leaver can still log in and post entries.
- Get the HR list of leavers in the period.
- Get the full user list from the system.
- Match them. Any leaver still active is an exception.
- For leavers who were disabled, compare the date of leaving to the date of removal.
- Check whether the account was used after the leaving date.
Also reverse the match. Look for active accounts that do not appear in HR at all, such as contractors and former staff.
A late removal is not automatically a failure. The question is whether the account was used, and whether a compensating control catches it. Document your reasoning.
Control 3: Privileged and special accounts
These have the most power. Test:
- The list of administrators, including database and vendor accounts.
- Whether each has a business reason.
- Whether shared or generic accounts exist, and how use is tracked.
- Whether activity of privileged users is logged and reviewed.
- How emergency or "firefighter" access is approved and reviewed afterwards.
- Service accounts: owner, password handling, whether interactive login is blocked.
Control 4: Periodic review
Do not accept a signed spreadsheet as proof. Test:
- Was the user list complete and from the system?
- Was the reviewer the right person?
- Did the reviewer make decisions on each line?
- Were removals actually processed, and when?
- Was it done within the stated period?
Pick a few removals marked in the review and confirm in the system they were disabled. This is the test many teams skip.
Segregation of duties
Access is also about conflicts, such as raising and approving a payment. Compare roles against a conflict list. See segregation of duties: designing and testing and the conflict matrix template.
Evidence to keep
- System-generated user list with extraction date.
- Screenshot or log of the query.
- HR leaver list.
- Approval tickets.
- Review sign-off and removal tickets.
- Notes on exceptions and conclusions.
Record test results in the ITGC audit workbook.
Common failures
- Population from the wrong source.
- Leavers removed late and used after leaving.
- Approval after access was granted.
- Generic admin accounts shared.
- Review done, but removals never processed.
Choosing a sample sensibly
For joiners, make sure the sample covers different roles and different approvers, not only the easy ones. For leavers, include people who left on bad terms or held finance roles, as the risk is higher. For privileged users, test all of them if the list is short. Use your methodology for sample sizes. Keep a note of why you selected the items you did.
Frequently Asked Questions
Who owns provisioning approval?
The owner of the data or process, not only IT.
Is a late termination a deficiency?
It is an exception. Evaluate whether the account was used and whether other controls cover it.
Do contractors count?
Yes. Include all people with system access.
How is this different from a periodic review?
A review looks back at what exists. Joiner and leaver controls prevent bad access appearing.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error