SOX has a strong impact on the relationship between IT control governance and IT control quality. Previously, internal control assertions were, for the most part, voluntary and based on
varying guidelines. This has changed. The Act specifically mentions Internal Control — Integrated Framework from the Committee of Sponsoring Organizations of the Tread way
Commission (COSO) as an international control framework for financial reporting. The Act identifies the need for general and application controls but does not provide a comprehensive set
of control objectives that need to be met by IT controls. Indeed, IT controls over program development, program change, computer operations, and access to programs and data that help
ensure the effective operation of specific controls are clearly considered as one type of company level control (PCAOB Standard No. 2).