The 2007 SOX guidance from the PCAOB[1] and SEC[2] state that IT controls should only be part of the SOX 404 assessment to the extent that specific financial risks are addressed, which significantly reduces the scope of IT controls required in the assessment. This scoping decision is part of the entity's SOX 404 top-down risk assessment. In addition, Statements on Auditing Standards No. 109 (SAS109)[3] discusses the IT risks and control objectives pertinent to a financial audit and is referenced by the SOX guidance.