A curated list of standards, implementation guidance, and tooling for COBIT, COSO Internal Control and COSO Enterprise Risk Management (ERM), and IT General Controls / IT Application Controls (ITGC/ITAC) — the frameworks that underpin most SOX 404 and financial-statement IT audit work.
Scope: Anything that materially helps a practitioner scope, design, test, or remediate controls against these frameworks — official standards, control matrices, testing methodologies, GRC platforms, and certification paths. Not generic accounting or audit content unrelated to IT controls.
Why now: PCAOB's amendment to AS 2201 (the standard governing audits of internal control over financial reporting) takes effect for fiscal years beginning after 15 December 2026, sharpening requirements around how auditors evaluate technology-related risks. COBIT 2019 remains ISACA's current governance framework, with the NIST CSF crosswalk guide keeping it relevant to security-driven audits. COSO's 2013 Internal Control and 2017 ERM frameworks remain the de facto global baseline nearly two decades after COSO began the modernisation.
Contributions welcome.
- Why These Frameworks Matter
- How to Approach Implementation
- COBIT
- COSO Internal Control and Enterprise Risk Management
- ITGC and ITAC
- Cross-Framework Mapping and GRC Platforms
- Open-Source Audit and Controls Tooling
- Assessment, Testing, and Control Matrix Resources
- Certifications and Training
- Government and Standards Bodies
- Learning Resources
- Related Lists
These four pieces fit together as layers, not alternatives. COSO's Internal Control – Integrated Framework is the conceptual backbone almost every SOX 404 program is built on: its five components (Control Environment, Risk Assessment, Control Activities, Information and Communication, Monitoring Activities) and seventeen principles are what management and auditors assess against when they conclude internal control is effective. COSO ERM sits alongside it as the enterprise risk lens, connecting control design to strategy and risk appetite rather than treating controls as a checklist. COBIT is the IT governance and management framework that translates those control objectives into IT-specific governance and management objectives, so a CIO or IT audit team has a structured way to organize IT policy, process, and accountability. ITGC and ITAC are where all of this becomes testable: ITGCs (access, change management, IT operations, sometimes program development) provide the control environment a financial application relies on, while ITACs (input completeness, accuracy, validity, and processing/output integrity) are the automated controls embedded inside a specific application or workflow.
A financial-statement or IT audit typically works top-down through this stack: COSO sets the control objectives, COBIT structures the IT governance and management response, and ITGC/ITAC testing is where an auditor gathers evidence that the controls actually operate.
- Scope the audit. Identify in-scope entities, business processes, and financial statement line items (a SOX scoping exercise), then trace those processes to the IT systems and applications that support them.
- Map the control environment to COSO. Assess entity-level controls against the five COSO components and seventeen principles. This is the foundation an auditor or management team references when concluding on control effectiveness.
- Assess risk using COSO ERM. Identify and prioritize the risks that threaten the in-scope objectives, connecting risk appetite and strategy to the specific controls chosen. This step determines how much testing depth each area warrants.
- Structure the IT governance response with COBIT. Use COBIT's governance and management objectives (across the Evaluate-Direct-Monitor, Align-Plan-Organize, Build-Acquire-Implement, Deliver-Service-Support, and Monitor-Evaluate-Assess domains) to organize policies, processes, and accountability for the in-scope IT environment.
- Identify ITGCs for each in-scope system. Document controls across the standard ITGC categories: logical access, change management, IT operations (backup, job scheduling, incident management), and, where relevant, program development / system implementation.
- Identify ITACs for each in-scope application. Document the automated controls embedded in the application itself: input validation, calculation logic, interface controls, and exception/error handling.
- Build a Risk and Control Matrix (RCM). Document each risk, the control that mitigates it, the control owner, frequency, and the type of evidence that will demonstrate operating effectiveness.
- Test design and operating effectiveness. Perform walkthroughs to confirm design, then sample-test operating effectiveness over the audit period.
- Report, remediate, and retest. Document deficiencies (control, significant, or material weakness under PCAOB definitions), track remediation, and retest before the reporting deadline.
- Monitor continuously. COSO's Monitoring Activities component and COBIT's Monitor-Evaluate-Assess domain both expect this to be an ongoing management responsibility, not an annual event.
Path to adoption: free framework downloads from ISACA (registration required), not itself certifiable, though ISACA offers individual certificates (Foundations, Design & Implementation).
- COBIT | ISACA - The official COBIT resource hub: framework downloads, focus areas, and the certification path.
- COBIT 2019 Framework: Introduction and Methodology - The foundational publication explaining COBIT's principles and how the framework is structured.
- COBIT 2019 Framework: Governance and Management Objectives - The 40 governance and management objectives across five domains (EDM, APO, BAI, DSS, MEA) that make up the core of the framework.
- COBIT Design Guide - Guidance for tailoring COBIT's generic objectives to an organization's specific context and risk profile.
- COBIT Implementation Guide - A phased approach (based on ISACA's continual improvement life cycle) for rolling out COBIT in an enterprise.
- Implementing the NIST Cybersecurity Framework Using COBIT 2019 - ISACA's official crosswalk between COBIT and NIST CSF, useful where security and IT governance audits overlap (see the companion Security Frameworks list).
Path to adoption: not certifiable; adopted by reference as the control framework management and auditors assess against. The full framework documents are paywalled (sold via AICPA/CPA2BIZ as COSO's licensing agent); COSO's own site provides free guidance pages and executive summaries.
- Internal Control - Integrated Framework | COSO - COSO's official guidance page for the 2013 Internal Control framework: overview, FAQs, and links to purchase the full framework and supplemental guidance. The full document is paywalled and not freely redistributable.
- COSO ERM Framework | COSO - COSO's official guidance page for the 2017 Enterprise Risk Management framework: overview and purchase links. Also paywalled in full.
- COSO - The Committee of Sponsoring Organizations of the Treadway Commission's home page: news, guidance thought papers, and the full publication catalog.
- AICPA & CIMA: COSO Internal Control - Integrated Framework - AICPA's resource landing page (COSO's licensing and distribution partner), including free implementation guidance alongside paid framework purchases.
Path to adoption: not a single named standard; ITGC/ITAC is the audit-execution vocabulary that PCAOB, AICPA, and ISACA guidance converge on. Scope and test as part of a SOX 404 or financial-statement IT audit, using COBIT and COSO as the conceptual scaffolding above.
- AS 2201: An Audit of Internal Control Over Financial Reporting - The PCAOB standard governing how an auditor evaluates internal control over financial reporting, including the IT-controls evaluation that drives ITGC/ITAC scoping. Amendment effective for fiscal years beginning after 15 December 2026.
- PCAOB Auditing Standards - The full current PCAOB standards library, the authoritative source for any ICFR audit requirement referenced above.
- AICPA SOC 2 Trust Services Criteria - The criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy) used in SOC 2 engagements; heavily overlapping with ITGC categories and frequently tested using the same evidence.
- ISACA IT Control Objectives for Sarbanes-Oxley - ISACA's guide mapping COBIT control objectives directly to SOX 404 IT control requirements, historically the standard reference for scoping ITGCs against COBIT.
- Secure Controls Framework (SCF) - Free, open (Creative Commons) meta-framework mapping outward to 250+ laws, regulations, and frameworks, including COBIT-adjacent and SOX-relevant control sets alongside NIST, ISO, and PCI-DSS. Shared with the companion Security Frameworks list.
- AuditBoard - Commercial GRC and SOX-management platform purpose-built for control matrices, walkthroughs, testing workflows, and issue tracking across ITGC/ITAC engagements.
- Workiva - Commercial platform for SOX compliance, internal controls management, and financial reporting workflows, with control-testing and certification modules.
- OneTrust - Enterprise GRC platform covering IT and financial controls alongside broader privacy and third-party risk management.
- Hyperproof - Commercial GRC platform focused on control-to-evidence traceability, usable across COSO/COBIT-driven programs as well as security frameworks.
- NIST OSCAL - NIST's open, machine-readable format for control catalogs and assessment results. Not COBIT/COSO-native, but increasingly used as the underlying data model for control-mapping tooling that spans IT audit and security frameworks.
- InSpec - Chef's open-source compliance-as-code framework. Useful for automating the technical evidence-gathering half of ITGC testing (configuration and access control checks) that feeds a manual control matrix.
- PCAOB Staff Audit Practice Alerts - Ongoing PCAOB guidance clarifying how AS 2201 and related standards should be applied in practice, including IT-controls-specific alerts.
- ISACA Audit and Assurance Resources - ISACA's library of audit programs, control matrices, and assurance guidance, several of which are COBIT-aligned ITGC test plans.
- AICPA Audit and Attest Standards - AICPA's standards and guidance library, the reference point for SOC 1/SOC 2 engagements that share testing methodology with SOX ITGC work.
- ISACA CISA - Certified Information Systems Auditor. The standard credential for IT audit professionals testing ITGC/ITAC and COBIT-aligned controls.
- ISACA CGEIT - Certified in the Governance of Enterprise IT, ISACA's credential most directly aligned with COBIT's governance objectives.
- ISACA CRISC - Certified in Risk and Information Systems Control, aligned with the COSO ERM risk-assessment step in the roadmap above.
- ISACA COBIT Certificates - COBIT Foundations and COBIT Design & Implementation certificates for practitioners implementing the framework directly.
- IIA Certified Internal Auditor (CIA) - The Institute of Internal Auditors' flagship certification, broader than IT but foundational for anyone running a COSO-based internal audit function.
- ISACA - The professional association that owns and maintains COBIT, and publishes CISA, CGEIT, and CRISC certifications.
- COSO - The Committee of Sponsoring Organizations of the Treadway Commission, publisher of the Internal Control and ERM frameworks.
- Public Company Accounting Oversight Board (PCAOB) - The US body that sets and enforces auditing standards, including AS 2201, for audits of public companies.
- AICPA & CIMA - The American Institute of CPAs, COSO's licensing and distribution partner, and publisher of SOC 1/SOC 2 attestation standards.
- The Institute of Internal Auditors (IIA) - The global professional association for internal auditors, publisher of the International Professional Practices Framework (IPPF).
- ISACA Journal - ISACA's practitioner journal, regularly covering COBIT implementation case studies and ITGC testing practice.
- COSO Guidance Thought Papers - Free supplemental thought papers from COSO on applying the Internal Control and ERM frameworks in specific contexts (fraud risk, cyber risk, and more).
- PCAOB Inspections Reports - Public PCAOB inspection findings, a practical view into where auditors most often find ITGC and ICFR testing deficient.
- AI Governance - A companion curated list covering AI-specific governance: regulation, standards, and runtime controls for autonomous agents.
- Security Frameworks - A companion curated list covering NIST CSF, ISO/IEC 27001, and PCI-DSS, with a shared control-mapping tooling section.
- Risk Management - A companion curated list covering the risk register, heat maps, and treatment planning that unresolved findings from this list feed into.
PRs welcome. See CONTRIBUTING.md for the criteria a new entry must meet.
This list is published under CC0 1.0 Universal. The linked resources retain their own licenses; the COSO Internal Control and ERM frameworks in particular are paywalled and not freely redistributable.