The SOX 404 requires that management must construct, implement, and maintain effective ICOFR. In addition, SOX 404 requires that the external auditor must propose an assurance report on the effectiveness of ICOFR. In this study, the development of the computer auditing system used was based on the Gowin's Vee research strategies, which suggest the combined knowledge of accounting and information technology to yield more positive results and generate better performance. The theatrical results shown eight proposed activity constructs and 34 auditing control items in the purchasing and expenditure cycle, which are necessary for system development. The researchers then established this system using the four phases of SDLC by further employing the case study method on two chosen public firms to validate the applicability of the system. The interview results obtained from the case firms agreed on the usefulness of the system to facilitate their company internal control. The system was found it can provide management and external auditors with the ability to identify incorrect financial statements and fraudulent activities. In conclusion, the suggested computer auditing system complies with the requirements set forth by SOX 404. It also improves the correctness of the auditing activities, thereby increasing the reliability of the company's investment and management environment. Finally, we believe this study can contribute to the development of a sufficient and manageable computer auditing system and future research can also expand other business cycle in the same way to reinforce the completeness of this computer auditing system.