“Can we prove our financial controls were working when it mattered?”
Every COSO component and principle, every SOX 302 and 404 obligation, and the IT general controls underneath them — access, change, operations and the service organizations you rely on. Dotwork ties them to the systems, changes, owners, suppliers and costs they cover, so the evidence comes from the work as it happens. Bring your own risk and control matrix as it is. When COSO issues new guidance, the remaps are proposed for approval and prior periods stay as assessed. Security, resilience and AI rules reuse the same controls. Dotwork does not certify anything — you and your auditors still conclude. It makes what they ask for easy to show.
The pressure
Most SOX programs run on a risk and control matrix in a spreadsheet, evidence in shared drives and testing status in email. Control owners attest the week before the deadline. Changes to in-scope systems go live without anyone checking which controls they touch. And the same access review is documented again for SOC 2 and ISO 27001.
What it looks like today
Full coverage
The matrix stops living in a spreadsheet. Each COSO principle, SOX obligation and ITGC maps to the systems, changes and costs it covers.
Built for COSO Internal Control — Integrated Framework (2013) · SOX 302 and 404
COSO principles 1–5.
COSO principles 6–9.
COSO principles 10–12.
COSO principles 13–17.
What the act asks of management.
The technology the numbers depend on.
What changes
Evidence assembled for the audit
Evidence read from the change, access and approval records as the work happens
A risk and control matrix in a spreadsheet
Risks, controls, owners and in-scope systems as records on one model
Changes to in-scope systems found at testing
Every change to an in-scope system checked against the controls it reaches
One control, documented once per framework
One control and one set of evidence, mapped to SOX, SOC 2, ISO 27001 and the rest
Change, checked against the controls
Pick a change to a financially significant system. Dotwork walks from it to the applications, capabilities and teams it touches, the key controls that cover them and whether those controls are attested and current. Unattested controls stand out before the change goes live, not at year-end testing. The contracts and past decisions behind the system sit in the same picture.
Where other tools stop
GRC suites hold the control matrix. Change tools hold the tickets. Neither knows which change reached which key control — so the gap surfaces at testing.
Flexed to how you run
No two companies scope SOX the same way. Dotwork keeps the COSO structure intact and lets the rest follow your own scoping.
Your matrix, as it is
Bring the controls, names and numbering your teams and auditors already use. COSO principles sit underneath for coverage and reporting.
Scope by system and process
Mark which applications, data stores, services and processes are in scope, and change it as the business does.
Your cadence, per control
Monthly, quarterly or annual attestation, set per control, with the next due date on every record.
Key controls first
Begin with key controls over the largest processes and the ITGCs beneath them, then extend to the rest of the matrix.
When guidance changes
When COSO or the regulators publish new guidance, Dotwork lines it up against your control matrix and suggests the remaps. The SOX program office signs off each one, and prior periods stay mapped as they were assessed.
Seventeen principles made explicit under the five components
Every control mapped to a principle, with principles no control covers shown as gaps
Points of focus added for each principle
Held as reference, so coverage can be checked without forcing a template
Technology general controls called out as their own principle
Principle 11 linked to the in-scope systems, changes and access it covers
Fraud risk assessed as a separate principle
Fraud risks recorded with their own likelihood, impact and response
Outsourced service providers brought clearly into scope
Suppliers and their assurance reports tied to the controls that rely on them
2026: COSO guidance on internal control over generative AI
AI and agents used in the close registered in AI Governance and linked to the controls that cover them
Every framework, one model
A finance team answers to SOX while security answers to SOC 2 and ISO 27001, and resilience and AI rules arrive on top. On Dotwork they share one library of controls instead of four.
NIST CSF · ISO 27001 · SOC 2 · COBIT · SEC cyber rules
ITGCs are security controls — one access or change control, evidenced once for SOX, SOC 2 and ISO 27001.
Explore Security & IT GovernanceEU DORA · NIS2 · UK op-res
The operations and recovery controls SOX relies on are the same ones resilience rules test.
Explore Operational ResilienceEU AI Act · NIST AI RMF · ISO 42001
AI and agents used in financial processes carry a risk tier and the controls that cover them.
Explore AI RegulationASC 350-40 · ASU 2025-06 · IAS 38
Capitalization rests on the same work records and controls the auditor tests.
Explore Software CapitalizationIT spend taxonomy
The cost of in-scope systems and of the controls themselves comes from the same reconciled ledger TBM allocates.
Explore TBMISO/IEC 19770 · licenses, contracts and renewals
In-scope systems carry their contracts and licenses, next to the controls that cover them.
Explore IT Asset ManagementAI-native financial controls
Chasing attestations, matching changes to controls and remapping for new guidance are prepared from the model. Nothing is attested, waived or concluded without a named person.
Follows each policy to the key controls that implement it and the in-scope systems they cover, and flags policies that reach nothing.
Groups every key control’s attestation as current, due soon, overdue or never attested, by owner and process.
Walks from the change to the controls it reaches and flags any that are unattested or past due.
Tracks each control exception as a dated waiver with an expiry, a renewal count and a remediation plan.
When a control is added or a framework comes into scope, proposes which SOX, SOC 2 and ISO 27001 requirements it already meets, and how closely.
Maps new COSO or regulatory guidance onto your control matrix and drafts the remaps it needs.
Drafts the status of key controls for management and the audit committee from the record.
Answers questions about controls, owners and evidence, citing the records behind every answer and the limits of what they prove.
Where it runs in Dotwork
Dotwork does not ask you to adopt a new method. The framework becomes a view over the same model these solutions already read and write.
How it compares
GRC and SOX suites run the control matrix, testing and workpapers — keep them if you have them. Spreadsheets cover what they don’t. Financial Controls on Dotwork connects every control to the systems, changes, suppliers and costs it covers, so the evidence comes from the work.
| Capability | GRC & SOX suites | Spreadsheets & shared drives | Financial Controls on Dotwork |
|---|---|---|---|
| COSO components and principles, mapped to controls | Partly | ||
| Risk and control matrix with owners | |||
| Attestations — current, due, overdue | Partly | ||
| One control mapped to SOX, SOC 2 and ISO 27001 | |||
| Exceptions as dated waivers with remediation plans | Partly | Partly | |
| Changes to in-scope systems traced to the controls they reach | Partly | ||
| New COSO guidance mapped onto the existing matrix | Partly | ||
| Mappings proposed and status packs drafted for review | Partly | ||
| Controls wired to systems, suppliers, costs and change |
Who it is for
“Can I sign the 302 certification knowing what changed this quarter?
“Which key controls are late, and which processes do they cover?
“Can this year’s control matrix carry forward instead of being rebuilt?
“Show me the evidence, who attested it and when.
“Which changes to in-scope systems touched a key control?
“Is anything here on its way to becoming a material weakness?
Before you buy
How to get a number instead of a pitch.
1
Good answer · One path from the change to the control, its owner and its last attestation.
Bad answer · A ticket export someone matches to the control matrix by hand.
2
Good answer · One control, mapped to both, with one set of evidence.
Bad answer · Two copies, documented and evidenced twice.
3
Good answer · No. You and your auditors conclude; the platform shows the evidence and its limits.
Bad answer · Yes — the dashboard says you are compliant.
More in Risk, Compliance & AI
Risk, Compliance & AI
The rules your controls have to prove they meet — including the new ones for AI.
The model underneath
Steer, Fund & Optimize and Govern & Deliver all read and write the same Enterprise Operating Model. The first module you license builds the model. Every module after it adds context instead of another silo — and Dotwork AI reads all of it, stopping where the decision is yours.
See the Enterprise Operating Model© 2025-2026 Dotwork, Inc. All rights reserved.