On-premise SOX audit software: why internal audit is quietly moving back on-prem

For a decade, the momentum in audit software pointed one direction: to the cloud. Every major GRC and audit-management vendor is cloud-first or cloud-only, and the pitch writes itself — no servers, always updated, accessible anywhere.

So it's worth paying attention to a counter-current that doesn't get conference keynotes: internal audit teams — especially small ones, and especially in regulated or security-conscious organizations — deliberately keeping their audit file on their own infrastructure. Not out of nostalgia. Out of a clear-eyed reading of what audit data is and what adopting a cloud vendor actually costs.

What's actually in an audit file

Start with the data. A SOX audit file is one of the most sensitive artifacts in a company:

• descriptions of every key control — which is to say, a map of exactly where the company's financial safeguards are, and by implication where they're weakest;
• evidence extracts: user access listings, payroll samples, journal entry populations, system configuration screenshots;
• deficiency evaluations — candid internal writing about what's broken, drafted before anyone has lawyered the language;
• names of who tested what, and reviewer challenge notes.

Ask your own security team how they'd classify that bundle. In most classification schemes it lands at the highest internal tier. Now notice the irony: internal audit — the function that reviews vendor risk management for a living — is the function being asked to hand that bundle to a new vendor.

The real cost of a cloud audit platform isn't the subscription

For a large audit function, the calculus often still favors cloud, and honestly so: they have the staff to run a proper vendor review and the scale to amortize it. The picture is different for a five-person SOX team:

The procurement tax. A cloud tool holding audit evidence triggers the full apparatus: security questionnaire, data-processing agreement, subprocessor review, maybe legal review of the MSA. In many companies that's a three-to-nine-month path, and it consumes the exact people (IT security, legal) whose goodwill internal audit needs for everything else. For a small team, the review can cost more effort than the tool saves in year one.

The dependency. Your audit file's availability now depends on a vendor's uptime, their continued existence, their pricing decisions at renewal, and your continued subscription. Audit workpapers have retention obligations measured in years; subscriptions are measured in invoices. "Export everything before we churn" is a real project people forget to budget.

The residency and access problem. Banks, insurers, defense-adjacent manufacturers, and subsidiaries of conservative parents often face rules — regulatory or corporate — that make placing this data in a foreign-hosted SaaS somewhere between painful and prohibited. And even where it's allowed, auditors know that a vendor can access hosted data in ways contracts constrain but physics doesn't.

None of this is an argument that cloud is wrong. It's an argument that for a specific, common team shape — small, restricted, procurement-averse — the cloud premium is paid in the team's scarcest currencies: time and political capital.

Why on-premise stopped being painful

The historical case against on-premise audit software was operational: a server to stand up, a database to administer, an IT project to get started. That case has quietly collapsed for small-team workloads, for a mundane technical reason: modern embedded databases and self-contained runtimes mean an "on-premise deployment" can now be a folder.

Here's what a current on-premise setup for a SOX team can look like — this is how SoxDesk works, and the pattern generalizes:

• The app is a portable folder. Unzip, double-click, it opens in your browser on localhost. No installer, no admin rights, no server team involved.
• The data store is a folder you choose. The database (a single SQLite file), evidence attachments, and automatic backups live together in one directory. Point it at a folder on your existing network share and every team member's install works on the same audit file — that's the entire multi-user deployment. Concurrency is handled by the application (server-enforced workpaper checkout, atomic locking), not by asking users to take turns.
• Security posture your IT team can verify in an afternoon: binds to 127.0.0.1 by default, no inbound exposure; no outbound calls at all except login-code email through your own SMTP server if you configure it; no telemetry; even license validation is an offline signature check. The security review reduces to "we run an exe and use a share we already govern."
• Backup and retention ride on what you already have. The app takes rotating automatic backups into the store folder, and because everything is plain files, your existing file-share backup and retention processes cover the audit file with zero special handling. In seven years, when someone asks for the FY2026 file, it's a folder copy — not a support ticket to a vendor you may no longer pay.

The old trade — "cloud is convenient, on-prem is a project" — has inverted for this class of tool. Downloading a zip is less project than a SaaS procurement.

The honest limits of on-prem

Fairness requires the other column. On-premise, small-team tools generally give up:

• Anywhere-access. Your data store is on the corporate network; working on the file means being on the network (VPN counts). For distributed-first teams this is a real cost.
• SSO and centralized identity, at least in lighter tools — user management is typically in-app.
• The platform breadth of the big suites: risk universes, board reporting, integrations. If you need those, you're shopping in a different aisle.
• Someone must own the folder. Not a server, but still a named person who knows where the store lives and that backups exist. In practice this is the audit manager, and the duty is minutes per year — but it's not zero.

If those trade-offs are dealbreakers, cloud is the right call, and you should make it with eyes open and a proper vendor review.

The pattern worth noticing

The teams moving back on-prem aren't rejecting modern software — they're rejecting a bundle. Cloud delivery bundled together good workflow software and a new custodian for your most sensitive data, and for years you couldn't get the first without accepting the second. That bundle has come apart. You can now get enforced sign-off workflow, connected reporting, ITGC scoping linkage, and roll-forward in software whose data never leaves the network — which, not coincidentally, is how the audit profession treated workpapers for its entire history before 2010.

If you want to see what this looks like concretely, SoxDesk's free 60-day trial is the full product as a portable zip — no account, no sales call, nothing leaves your machine. Unzip it, load the sample SOX audit, and show the security-overview one-pager to your IT team; their reaction to "it's localhost and a folder" is usually the fastest part of the whole evaluation.