sox-compliance-mcp

MCP server for Sarbanes-Oxley (SOX) compliance — browse internal control requirements, assess audit readiness, generate ITGC and business process control policies, evidence checklists, gap analysis, and deficiency evaluation for public companies.

Built for compliance teams, internal auditors, SOX program managers, and external audit support.

Tools

| Tool | Description | |------|-------------| | browse_controls | Browse SOX controls by section (302/404), category (ITGC/business process/entity-level/disclosure), COSO component, or control type | | assess_readiness | Score compliance readiness based on implemented controls with filer-category-aware recommendations | | generate_policy | Generate detailed policy documents for any SOX control with implementation guidance | | evidence_checklist | Generate evidence collection checklists, walkthrough templates, or testing matrices | | gap_analysis | Compare implemented controls vs. requirements with prioritized remediation timeline | | evaluate_deficiency | Classify deficiencies as material weakness, significant deficiency, or control deficiency per PCAOB AS 2201 |

Controls Coverage

• IT General Controls (ITGC): Access management, authentication, privileged access, change management (application + infrastructure), SoD, job scheduling, backup/recovery
• Business Process Controls: Journal entries, account reconciliation, financial close, revenue recognition (ASC 606), vendor master, three-way match
• Entity-Level Controls: CEO/CFO Section 302 certification, risk assessment, management review/monitoring, audit committee (Section 301)
• Disclosure Controls: Section 409 real-time disclosure, Section 802 record retention, Section 806 whistleblower protection

Install

npx sox-compliance-mcp

Claude Desktop

{
  "mcpServers": {
    "sox-compliance": {
      "command": "npx",
      "args": ["-y", "sox-compliance-mcp"]
    }
  }
}

Examples

Browse all ITGC controls:

browse_controls({ category: "itgc" })

Assess readiness for an accelerated filer:

assess_readiness({ implementedControls: ["ITGC-01", "ITGC-02", "BP-01", "EL-01"], companyType: "accelerated_filer" })

Generate a change management policy:

generate_policy({ controlId: "ITGC-04", companyName: "Acme Corp" })

Get a walkthrough template for business process controls:

evidence_checklist({ category: "business_process", format: "walkthrough" })

Evaluate a deficiency:

evaluate_deficiency({ deficiencyDescription: "Quarterly access reviews not completed for ERP system", controlId: "ITGC-01", financialStatementImpact: "more_than_inconsequential", likelihoodOfOccurrence: "reasonably_possible", compensatingControls: false })

License

MIT