A US public company moves its general ledger and financial reporting applications to a SaaS provider. The company's external auditors are preparing their review of internal control over financial reporting. What is the main Sarbanes-Oxley implication of this move?

The Sarbanes-Oxley Act requires management of public companies to establish and assess internal control over financial reporting, with executives certifying financial reports and external auditors reporting on those controls. When financial systems move to a cloud provider, the provider becomes part of the company's control environment, yet responsibility stays with management. The company must understand which provider controls affect financial reporting, obtain assurance over them, typically through a SOC 1 Type II report, and implement the complementary user entity controls the report identifies, such as reviewing access and reconciling outputs. Claiming responsibility transfers to the provider is wrong; the provider does not certify the customer's financial statements, and outsourcing never transfers this accountability. Treating hosted systems as out of scope misreads the law; the location of a system does not remove it from internal control over financial reporting if it supports financial statements. A SOC 3 report is a general-use summary of trust services criteria and lacks the detailed description and tests financial auditors need, so it is not the expected evidence. Exam caveat: data retention and change management at the provider also matter for financial record integrity. Operational check: confirm a current SOC 1 Type II report is obtained annually, reviewed for exceptions and mapped to owned user controls.