LedgerCast

A Python-based IT General Controls (ITGC) testing toolkit that simulates how an internal auditor tests SOX ITGC controls and generates a professional audit report.

Note: This is a portfolio project simulating real ITGC methodology, built to also be genuinely reusable.

What this project demonstrates

• ITGC / SOX Control Testing Methodology: Modeling realistic control objectives and testing logic.
• Segregation of Duties (SoD) Analysis: Building pairwise conflict matrices and evaluating user role configurations.
• Risk & Control Matrix (RCM) Design: Mapping test procedures to frequencies and risk ratings.
• Framework Crosswalking: Mapping controls to ISO 27001, NIST CSF 2.0, and COBIT 2019.
• Python CLI Packaging: Structuring a reusable command-line tool with stateful findings management.
• Interactive Dashboards: Client-side data parsing and rule evaluation without a backend.

What it tests

The toolkit automatically tests the following controls:

1. ITGC-AM-01 (Access Management): Terminated employees' system access must be revoked on or before their termination date.
2. ITGC-CM-01 (Change Management): All production changes must have a documented, approved change ticket before deployment.
3. ITGC-BR-01 (Backup & Recovery): Scheduled backup jobs must complete successfully within their defined window; failures must be identified.
4. ITGC-SOD-01 (Segregation of Duties): No single user should hold two or more roles that together create a fraud or error risk.

Two ways to use it

CLI (recommended for repeated use)

git clone https://github.com/dedsec-terminal/LedgerCast.git
cd LedgerCast
pip install -e .
ledgercast test              # run tests against bundled sample data
ledgercast findings list     # view open findings
ledgercast report            # generate the docx audit report

Note that once installed with pip install -e ., the ledgercast command is available from any directory since pip adds the console script to your PATH.

GUI (interactive dashboard)

Visit the hosted dashboard at https://dedsec-terminal.github.io/LedgerCast/, or open docs/index.html locally via a web server:

# From repo root — required for the sample data fetch to work
python -m http.server 8080
# Then open http://localhost:8080/docs/index.html

The dashboard is a fully interactive SPA that loads with bundled sample data by default. It features:

• Findings Register: A centralized table tracking open exceptions by risk, status, and control.
• Framework Mapping: Control tags mapped to ISO 27001, NIST CSF, COBIT 2019, and SOX.
• Live Re-testing: To test your own data, use the "Upload CSV" button on any control card. All processing runs entirely client-side in the browser; no data is transmitted.

Extending and Customizing

• Want to add new controls or point the CLI to your own CSV exports? See docs/CUSTOMIZING.md.
• Need to know the exact CSV schemas required? See data/README.md.

Repo structure

ledgercast/
├── data/
│   ├── README.md                 ← Schemas and sample data guide
│   ├── findings_state.json       ← Persistent findings store (source of truth)
│   ├── backup_job_log.csv
│   ├── change_log.csv
│   ├── sod_ruleset.csv
│   ├── user_access_list.csv
│   └── user_role_assignments.csv
├── docs/
│   ├── CUSTOMIZING.md            ← Guide for adding new controls
│   ├── framework_mapping.json    ← Compliance framework mappings
│   ├── index.html                ← GitHub Pages dashboard
│   ├── RCM.md                    ← Risk & Control Matrix
│   └── sample-data/              ← Dashboard data (auto-synced from data/)
├── ledgercast/                   ← Python package
│   ├── cli.py                    ← CLI entry point
│   ├── findings.py               ← Findings lifecycle engine
│   ├── generate_report.py
│   ├── run_all_tests.py
│   ├── test_access_management.py
│   ├── test_backup_recovery.py
│   ├── test_change_management.py
│   └── test_sod.py               ← Segregation of Duties logic
├── reports/
│   └── ITGC_Testing_Report.docx
├── pyproject.toml
└── README.md