US federal law on financial reporting; Section 404 mandates internal controls over financial reporting (ICFR).
The Sarbanes–Oxley Act of 2002 governs financial reporting for US public companies. Section 404 requires management (404a) and external auditors (404b) to assess and attest to the effectiveness of internal control over financial reporting (ICFR). IT general controls (ITGCs) are typically in scope for any system that materially affects financial reporting.
Run a free ComplianceIQ audit against SOX and we'll surface every gap on this — and the other controls auditors flag — with the exact clause references to fix.