The SOX is a US federal law, enacted in 2002 in response to some of the biggest financial scandals of all time. This law, aimed at protecting investors, imposed important changes regarding the audit activities for companies listed on the American stock exchanges. Among all the sections of the law, the Article 404 significantly affected the IT audit. This article requires the management of a corporation to establish and maintain a structure of internal controls to safeguard the accuracy of the financial information stated in the financial statement. External auditors are required to perform an annual assessment of internal controls in order to evaluate their effectiveness.