Frameworks · United States
Auditors test program-change controls and rely on system-produced reports only when they are complete and accurate. Aspian Cloud gives them a complete change population, with drift included, that they can verify themselves.
- Instrument
- Sarbanes-Oxley Act of 2002, Section 404 (management assessment of internal controls); PCAOB AS 2201 (An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements); PCAOB AS 1105 (Audit Evidence)
- In force
- SOX s.404 in force since 2002 (404(b) auditor attestation for accelerated filers). AS 1105 amended by the PCAOB technology-assisted analysis amendments (Release 2024-007, SEC-approved Aug 2024), effective for fiscal years beginning on or after 15 December 2025
- For
- US-listed companies and their auditors, for systems that touch financial reporting.
| Clause | What it requires | Evidenced by |
|---|---|---|
| SOX s.404(a)-(b) | Management must assess and report on the effectiveness of internal control over financial reporting each year, and the external auditor attests to it for accelerated filers.Source: sec.gov | Change records for every in-scope system across the year, with approvals by people independent of the author. |
| AS 2201 Appendix B, .B28-.B33 | Auditors may benchmark automated controls across years only when IT general controls, especially over program changes, remain effective.Source: sapblog.protiviti.com | A complete change population by construction: deploys found by drift detection are listed with how each was resolved. |
| AS 1105.10 | Before using company-produced information as evidence, auditors test its accuracy and completeness, directly or through IT general and automated controls.Source: pcaobus.org | Signed evidence an auditor can verify offline with the published method, without trusting Aspian. |
Clause references and requirements were read on 8 November 2026. The standard is paywalled or the official site refused access, so references were confirmed from reputable secondary sources. Aspian Cloud evidences these clauses; it doesn’t make you compliant, and your assessor decides.
Want the mapping for a framework we don’t list? Ask us. A new framework is a data file, not a code change.
See what shipped without approval in your last 90 days.
Install the GitHub App and the scan arrives in minutes: every repo scored, every unreviewed merge and unapproved deploy named. Nothing is blocked until you choose.
Ship like a startup. Prove it like a bank.