What is IT’s role in Sarbanes Oxley?

Software, applications and databases utilized to process financial transactions of publicly traded companies, as well as the servers housing these systems are required to be Sarbanes-Oxley compliant. The AICPA has defined 5 systrust principles (availability, integrity, confidentiality, security and privacy) to support the financial statement audit assertions (completeness, accuracy, validity, rights and obligations, existence, presentation and disclosure). As part of the Sarbanes Oxley 302 process, management must certify controls supporting the systrust principles are in place and operating effectively for all in-scope systems.