This publication, which serves as a companion to Protiviti's Section 404 book, Guide to the Sarbanes-Oxley Act: Internal Control Reporting Requirements, offers guidance to Section 404 compliance project teams on the consideration of IT risks and controls at both the entity and activity levels within an organization. The questions and answers focus on the interaction between the IT organization and the entity's application and data-process owners, and explain the implications of general controls and how they are considered at the process level. The guide also explores how application-control assessments are integrated with the assessment of business-process controls, and addresses documentation, testing and remediation matters.

Download Guide to the Sarbanes-Oxley Act: IT Risks and Controls (PDF)  (requires Acrobat Reader; please disable your pop up blocker)