Skip to content
VITI Security
Contact

SOX 404

SOX ITGC Cost Estimator

Estimate first-year and ongoing IT general controls readiness + audit cost by auditor tier and system scope.

SOX 404 applies to SEC registrants; private companies may adopt ITGC voluntarily or ahead of an IPO.

Systems that feed financial reporting (ERP, billing, payroll, key databases).

What are SOX ITGCs?

Section 404 of the Sarbanes-Oxley Act requires public companies to assess their internal control over financial reporting. IT general controls (ITGCs) are the controls over the systems that produce the financial numbers. Auditors typically group them into access to programs and data, program changes, program development and computer operations. If ITGCs fail, the auditor cannot rely on the automated controls and reports that depend on those systems.

404(a) and 404(b)

  • 404(a): management assesses and reports on internal control over financial reporting each year.
  • 404(b): the external auditor attests to that assessment, under PCAOB AS 2201. Non-accelerated filers are exempt, and newly public companies get a transition period (Regulation S-K Item 308).

In May 2026 the SEC proposed narrowing the 404(b) attestation requirement (File S7-2026-18). Check its status before planning around it.

Where ITGCs most often fail

  • User access reviews done but not documented or evidenced
  • Leavers' access removed late
  • Segregation of duties conflicts, especially developers with access to production
  • Change approvals missing, or given after the change
  • Logging too thin to prove a control operated

Auditors also need evidence that a control operated for long enough; a control switched on just before year end often cannot be relied on.

What it costs

The estimator above adds readiness work (per system in scope, scaled by how many control areas are missing) to an external audit fee band for the auditor tier you choose. There is no public fee schedule, so the bands are our planning estimates.

We do the technical side: access reviews, deprovisioning, change control and logging. See vCISO services.

Sources

Facts checked against the sources above on 22 October 2026. General information, not legal advice.

How this is calculated

  1. Readiness = systems in scope x US$15,000-40,000 per system, scaled by a gap factor of 0.5 + (missing control areas / 5): 0.5 when all five ITGC areas exist, 1.5 when none do.
  2. External audit = a yearly fee band for the auditor tier you pick: Big 4 US$150,000-500,000, mid-tier US$75,000-250,000, boutique US$40,000-150,000.
  3. First year = readiness + audit. Ongoing = 60% of the first-year low end to 70% of the high end.
  4. Colour: for a public company, red with 3 or more control areas missing, otherwise amber; green if you are not public.

Constants the tool uses

Unless a value names a study, it is VITI Security's working estimate for budgeting - not taken from a statute or a dated study - so treat it as an adjustable assumption.

Readiness per in-scope system
US$15,000-40,000
Gap factor
0.5 + missing areas / 5
Audit fee: Big 4 / mid-tier / boutique
US$150k-500k / 75k-250k / 40k-150k a year
Ongoing cost
60%-70% of year one

Worked example

The calculator run on its default inputs:

Public company (or pre-IPO)?
Yes
IT systems in SOX scope
5 systems
ITGC already in place
Change management (tickets + approvals); Audit logging & retention
External auditor tier
Mid-tier / national firm

Estimated SOX ITGC cost

$157.5K-$470K yr 1

Applicability
SOX 404(a) management assessment applies; 404(b) auditor attestation only if you are an accelerated or large accelerated filer
First year: readiness (5 systems, 3/5 control areas missing) + audit
$157,500-$470,000
Ongoing annual (audit + evidence + maintenance)
$94,500-$329,000
Auditor tier fee assumption
Mid-tier: $75,000-$250,000/yr

Five systems with two of five control areas in place give a gap factor of 0.5 + 3/5 = 1.1, so readiness is 5 x US$15,000-40,000 x 1.1 = US$82,500-220,000. Adding the mid-tier audit band (US$75,000-250,000) gives US$157,500-470,000 in year one and US$94,500-329,000 a year after that.

Sources

Sources last checked September 2026.

Limitations

There is no public fee schedule: audit fees depend on the company, the auditor and its history of findings. The model treats every system alike and does not price SOC 1 reports from service providers or remediation of audit findings. This is an indicative estimate for education and planning, not legal advice. Laws and published figures change, and regulators and courts apply discretion no calculator can model - confirm with a qualified legal or compliance professional before acting on a result.