SOX Continuous Control Monitoring

ScreenSarbanes-Oxley (SOX)·step 1

Complete the Identity fields. Each value is validated against the schema before the next step unlocks.

• Domain entity ID (required)

  entityId

  The organisation or system this record is about — lowercase with dashes, e.g. acme-corp-hq. Pick one you have used before, or type a new id to create it.

• Control being monitored (required)

  controlId

  Enter control being monitored.

• Monitoring mechanism (required)

  mechanismId

  Enter monitoring mechanism.

ScreenSarbanes-Oxley (SOX)·step 2

Complete the Authority fields. Each value is validated against the schema before the next step unlocks.

• Conclusion kind (required)

  conclusionKind

  A determination may be automated end to end. A judgement requires a named human under

ScreenSarbanes-Oxley (SOX)·step 3

Complete the AI fields. Each value is validated against the schema before the next step unlocks.

• A generative model participates in this mechanismoptional

  usesGenerativeModel

  Participating is permitted. Deciding is not — see decidedBy.

• Model versionoptional

  modelVersion

  Enter model version.

• Model configuration versionoptional

  modelConfigVersion

  Enter model configuration version.

• Prompt referenceoptional

  promptRef

  Sufficient to reconstruct what the model acted on.

• Human review evidenceoptional

  humanReviewEvidenceId

  Enter human review evidence.

ScreenSarbanes-Oxley (SOX)·step 4

Complete the Validation fields. Each value is validated against the schema before the next step unlocks.

• Model validated onoptional

  modelValidatedOn

  Enter model validated on.

• Revalidation due onoptional

  revalidationDueOn

  An expired validation is a control condition, not a maintenance ticket.

• Drift indicator observedoptional

  driftIndicatorObserved

  Enter drift indicator observed.

ScreenSarbanes-Oxley (SOX)·step 5

Complete the Operating fields. Each value is validated against the schema before the next step unlocks.

• Operating period startoptional

  operatingPeriodStart

  Enter operating period start.

• Operating period endoptional

  operatingPeriodEnd

  Enter operating period end.

• Monitoring lapsed fromoptional

  lapseStart

  A gap in coverage for that interval — surfaced, never smoothed.

• Monitoring resumed onoptional

  lapseEnd

  Enter monitoring resumed on.

ScreenSarbanes-Oxley (SOX)·step 6

Complete the Coverage fields. Each value is validated against the schema before the next step unlocks.

• Approach (required)

  monitoringApproach

  Enter approach.

• Population size (required)

  populationSize

  Enter population size.

• Items evaluated (required)

  itemsEvaluated

  A full-population claim requires this to EQUAL the population. An automated mechanism that skipped records has not tested the population.

• Population definition (required)

  populationDefinition

  Enter population definition.

ScreenSarbanes-Oxley (SOX)·step 7

Complete the ITGC fields. Each value is validated against the schema before the next step unlocks.

• ITGCs over this mechanism assessed underoptional

  itgcAssessed

  Access, change management and operational monitoring over the monitoring tooling itself.

ScreenSarbanes-Oxley (SOX)·step 8

Complete the Audit fields. Each value is validated against the schema before the next step unlocks.

• Decided by (required)

  decidedBy

  Which layer produced this conclusion. Only the deterministic engine or a human may decide a control outcome.

• Rule version (required)

  ruleVersion

  Version of the rule that produced the conclusion. Without it the conclusion cannot be reproduced after the rule changes.

• Rule packageoptional

  rulePackage

  Rego package or module identifier the rule lives in.

• Inputsoptional

  conclusionInputs

  The facts the rule read. A conclusion without its inputs cannot be re-derived or challenged.

• Reason (required)

  conclusionReason

  Human-reviewable explanation of the outcome. This is the explainability an auditor asks for.

• Evaluated at (ns)optional

  evaluatedAtNs

  Nanosecond evaluation stamp, matching the engine freshness input.

• Human reviewed atoptional

  humanReviewedAt

  When a human confirmed the conclusion, where review was required.

• Human reviewed byoptional

  humanReviewedBy

  Enter human reviewed by.