IT Controls & Security for Finance and Accounting Teams
Clean audits, secure payments, and controls your team can actually live with.
Review Your Finance ControlsOverview
Finance and accounting teams sit at the center of audit, payments, and reporting. That makes them a primary target for invoice fraud and a primary focus for auditors testing IT general controls.
DeBerry Contracts helps CFOs and controllers design SOX-ready controls that fit how the team works. We secure ERP and accounting systems, build evidence auditors accept the first time, and stop payment fraud before money leaves the account.
Challenges We Solve
- Auditors flag excessive access, missing change approvals, and incomplete evidence in finance systems.
- Vendor impersonation and fake invoice schemes target accounts payable teams.
- Spreadsheets and shared mailboxes hold critical financial data without proper protection.
- Retention and deletion rules for financial records are unclear or not enforced.
What We Do
SOX ITGC Design & Testing
Control matrices covering access, change management, operations, and backups, tested before your auditors arrive.
ERP & Accounting System Access Reviews
Role-based access, segregation of duties, and quarterly reviews with documented sign-off.
Payment & Invoice Fraud Prevention
Vendor change verification, email protection, and approval workflows for every payment.
Financial Data Protection
Sensitivity labels, data loss prevention, and encryption for financial workbooks and reports.
Records Retention & eDiscovery
Microsoft 365 retention policies and immutable backups that satisfy Section 802 obligations.
Copilot for Finance
Variance explanations, report drafting, and reconciliation support with Microsoft Copilot.
Who We Serve
CFOs & Controllers
Finance leaders accountable for reporting accuracy
Accounts Payable & Receivable
Teams moving money every day
Internal Audit
Teams testing and monitoring internal controls
Accounting Firms
CPA and bookkeeping firms protecting client financials
Frequently Asked Questions
Let's Connect
Talk with a specialist about your finance & accounting teams needs.
Review Your Finance Controls Sales@deberrycontracts.comMore Financial Services
SOX and ICMM Controls, Explained
Every requirement, what it means for your systems, and the quick win that gets you there faster. Open any section to see the details.
Sarbanes-Oxley IT Security Requirements by Section
Sarbanes-Oxley is a financial reporting law, but nearly every section depends on IT controls. Here is what each section means for your systems, and the fastest way to get audit-ready.
- Access controls so only authorized personnel can modify financial data.
- Logging and monitoring to track changes to financial reports and data.
- Data integrity checks such as checksums or hashing to prove data has not been altered.
Enable Microsoft Purview audit logging and restrict finance system admin rights to named individuals.
- Encrypted transmission for financial data shared with external parties.
- Data classification policies that identify and protect sensitive financial information.
- Regular review of security policies to keep pace with disclosure requirements.
Apply sensitivity labels to financial workbooks so encryption follows the file wherever it goes.
- Regular risk assessments of IT systems that handle financial data.
- Multi-factor authentication on every system that accesses financial data.
- Documented IT controls, including formal change management.
- Periodic testing of control effectiveness with documented results.
Enforce MFA through Entra ID Conditional Access and keep a single control matrix your auditor can test against.
- Real-time monitoring to detect unauthorized access or changes to financial data.
- Secure, redundant disclosure systems that prevent downtime.
- Secure communication channels for urgent disclosures.
Route finance-system alerts into a monitored queue with a defined escalation owner.
- Data retention policies that define how long financial records are kept.
- Data loss prevention to stop unauthorized deletion or alteration.
- Backups that can recover from accidental or malicious deletion.
Configure Microsoft 365 retention policies and immutable backups for finance mailboxes and SharePoint sites.
- Secure, anonymous reporting channels that protect the reporter’s identity.
- Access to whistleblower reports restricted to authorized personnel.
- Regular audits of the reporting process for effectiveness and security.
Use a dedicated third-party hotline and lock its admin access to the audit committee.
- Controls that prevent unauthorized access to audit data and documents.
- Secure audit trails tracking access and changes to financial records.
- Secure, read-only auditor access that preserves data integrity.
Provision auditors as time-limited guest accounts with read-only access to a dedicated evidence site.
- Controls ensuring the accuracy and completeness of financial reports.
- Encryption of sensitive financial data at rest and in transit.
- Security policies updated as reporting requirements change.
Pair BitLocker device encryption with TLS-only mail flow to cover data at rest and in transit.
SOX Internal Control Maturity Model (ICMM) IT Security Measures
The ICMM organizes SOX IT controls into domains you can measure and mature over time. These are the controls auditors look for first.
- Role-based access control restricting financial systems by job role.
- Strong authentication such as MFA to verify identities.
Run quarterly access reviews with Entra ID Access Reviews and keep the sign-offs.
- Encrypt sensitive financial data at rest and in transit.
- Use secure protocols such as HTTPS and TLS for all transmission.
Turn on device encryption policies in Intune and block legacy, unencrypted protocols.
- Formal process ensuring changes are authorized, tested, and documented.
- Logs of all changes made to financial systems and data.
Require a ticket number on every production change and keep approvals in one system.
- A plan addressing breaches that could impact financial reporting.
- Procedures for identifying, reporting, and mitigating incidents.
Run one tabletop exercise per year and file the after-action report as audit evidence.
- Track access to financial systems and detect unauthorized activity.
- Review logs regularly for suspicious activity and anomalies.
Centralize logs in Microsoft Sentinel or Defender and schedule a weekly review.
- Regular backups so financial data can be restored after loss or corruption.
- Periodic testing of backup and recovery processes.
Document one successful restore test per quarter. Auditors want proof, not policy.
- Regular assessments of IT systems that handle financial data.
- Evaluation of how cyber threats could affect financial reporting.
Maintain a living risk register tied directly to your control matrix.
- Ongoing training on IT security and safeguarding financial data.
- A culture of security awareness across the organization.
Run monthly phishing simulations with finance-specific lures like invoice and wire fraud.
- Protect infrastructure and data centers hosting financial systems.
- Control physical access to sensitive areas and equipment.
Collect SOC 2 reports from your hosting providers to cover data center controls.
- Assess the security of vendors with access to financial data or systems.
- Include security requirements and compliance obligations in vendor contracts.
Tier vendors by data access and request SOC 1 or SOC 2 reports from the top tier annually.
- Thorough documentation of IT security policies, procedures, and controls.
- Regular updates reflecting regulatory changes and best practices.
Version every policy with an owner and annual review date.
- Regular internal and external audits of financial reporting IT controls.
- Timely remediation of identified deficiencies.
Track every audit finding to closure with an owner and due date.
Ready to Get Started?
Clean audits, secure payments, and controls your team can actually live with.