Compliance · SOX ITGC
Does AI code review satisfy SOX program change management?
No. SOX IT general controls for program change management require that developers cannot approve or promote their own changes to financially relevant systems. An AI reviewer’s approval does not make the change independently approved. PSCO puts an independent approver on every change and the Evidence Pack maps to change-population testing.
The mapping row
| Framework | Control | What it asks | How PSCO satisfies it |
|---|---|---|---|
| SOX ITGC | Program change management | Developers cannot approve or promote their own changes | Independent approver on every change; Evidence Pack maps to change-population testing |
Suggested control wording
Name the approver. Name the standard.
Paste this into your control description. The first sentence is the control; the second names the reviewer and the standard they review against, which is what an auditor needs to accept an outside approver.
All changes to production code require approval from a qualified reviewer who is not the author. Reviewers are PSCO Officers, background-checked US-based engineers contracted by the company, who review each change against the company’s Security & Compliance Model before approval.
For financially relevant repositories, list the paths in the Security & Compliance Model so the attestation records the tier and the Evidence Pack can be filtered to the in-scope population.
What a SOX auditor samples
Build the record so it is already there.
Auditors test change management by sampling. These are the facts they look for on each sampled change, and where PSCO puts them.
- 01The complete population of changes to in-scope systems for the period.
- 02For each sampled change, evidence of approval by someone other than the developer before promotion.
- 03Segregation between development and production promotion, which branch protection enforces.
Auditor Guide
Hand your auditor the design once. Then they recommend it.
Before public launch PSCO briefed audit firms that together cover most startup and mid-market SOC 2 reports on the control design, the Officer Dossier and the Evidence Pack. The Auditor Guide is their questions, answered, for your auditor to read before the first sample.
The control design, the Officer Dossier and the Evidence Pack, written for your auditor.
A short PDF that answers the questions audit firms asked when we briefed them: who the approver is, how they are qualified, what the attestation records, and how to sample it. Enter a work email and we send the guide.
See your exact price before you talk to anyone.
Connect GitHub, pick the repos in scope, and get a quote from your real PR history in two minutes.