Section 404 of the landmark Sarbanes–Oxley Act (SOX) requires public companies to report
the effectiveness of their internal control systems and requires auditors to verify management's
reports as well as to provide their own reports on the effectiveness of the internal control systems.
Considering that most companies' business transactions are routinely electronic, IT systems have
become an integral part of companies' internal control systems. The Public Company Accounting
Oversight Board (PCAOB) specifically states that IT control should be considered as companylevel
control or application level, given the extensive and pervasive usage of IT in the companies'
daily business processes and transactions (PCAOB, Standard No. 2, 2004).