An example of SOX ITGC audit as a governed process: agents do the 9 steps, and a person signs the gate before anything irreversible happens. Download it, import it into your workspace, and adapt it to your systems.
minctrl.process/v1 · hash 841e6239581c…b5c1
SOX ITGC testing is the most repetitive part of assurance — access reviews, change evidence, control execution — yet only a licensed CPA may issue the ICFR opinion. Controls tested and exceptions severity-rated straight-through; the engagement partner signs the ICFR opinion before it is issued.
Concluding that a control is effective (or waiving a deficiency) is an audit judgment that can mislead a SOX filing, so an auditor or control owner signs off the control conclusion before it's recorded.
| Rule | What it requires |
|---|---|
| SOX Section 404 ITGC | IT general controls over access, change management and operations must be designed and operating effectively, and management/auditors must be able to evidence that with tested controls. |
| Segregation of duties (SoD) | The person who executes a change or transaction can't also be the one who approves it; toxic-access combinations are a reportable control weakness. |
| Change-management & access-review evidence | Access recertifications and change approvals must be documented with who requested, who approved, and when — the evidence, not just the assertion. |
A summary for orientation, not legal advice.
A minctrl.process/v1 document: the graph and the hash of the process it becomes.
Import into Minctrl opens this example in your workspace; one click stores it as your first version. Import JSON does the same with the file, and a file changed after download is refused.
Every connector starts in shadow: steps run, nothing leaves Minctrl until you configure a connector and switch it live.
Change signers, time limits and steps on the canvas. Each save is a new version; a running case stays on the version it started with.
The AI agent collects control evidence and tests access, change-management and segregation-of-duties controls, but every test carries the underlying evidence and a tamper-evident audit hash. Because runs are deterministic and replayable, a reviewer can re-run a test and get the same result and the same workpaper.
No. Concluding that a control passes — or waiving a deficiency — is an audit judgment that can mislead a SOX filing, so it parks at a control-conclusion gate for an auditor or control owner. The AI does the testing and exception-flagging; a person owns the conclusion.
The flow tests for toxic-access combinations where one person could both execute and approve, flags them as potential deficiencies, and routes them for human review with the supporting access data recorded — so SoD conflicts are evidenced rather than assumed away.