How would you determine scope of SOX relevant applications, processes? Which IT controls would be relevant? How would you address timing, testing frequency? What regulatory guidance can be used to determine compliance? What departments would need to be involved? Describe how you would approach external auditing firm to gather requirements, use of internal audit and timing