What Is SOX Compliance?

The Sarbanes-Oxley Act governs financial reporting for public companies in the United States. Its relevance to security comes through internal controls over financial reporting, which include the technology controls supporting financial systems.

It is not a security regulation. It is a financial reporting regulation with technology consequences, and treating it as the former produces scope that is both too broad and misdirected.

Where technology enters

Section 404 requires management to assess the effectiveness of internal controls over financial reporting, with external auditor attestation for larger filers.

Because financial reporting depends on systems, controls over those systems fall within the assessment. That is the entire connection, and it determines scope precisely: systems that affect the financial statements.

General technology controls

Access to programs and data — who can reach financial systems, how access is granted and removed, and whether privileged access is controlled and reviewed.

Change management — that changes to financial systems are authorised, tested and approved. Operations — job scheduling, backup and recovery, incident handling. And development, where systems are built or substantially modified.

Segregation of duties is the recurring finding

The same person should not be able to both initiate and approve a financial transaction, nor to develop and deploy changes to a financial system without independent review.

In smaller organisations this collides directly with headcount. The accepted answer is compensating controls — detective review by someone independent, documented and evidenced — rather than pretending the separation exists.

Evidence has to cover the period

Auditors test whether controls operated throughout the reporting period, using samples drawn from across it. A control implemented in the final quarter does not support an annual assertion.

Which makes continuous evidence generation the practical requirement. Access review records, change approvals and monitoring output all need to exist for the whole period, and cannot be reconstructed.

Its relationship to security work

The overlap is real but partial. Access control, change management and logging serve both purposes, and the discipline this regulation imposes frequently improves security in those areas.

It says nothing about threats, detection, response or recovery beyond what financial reporting requires. Treating a clean audit as evidence of security is the error this area invites most readily.

Automation of the evidence, not the control

Access reviews, change approvals and privileged activity logs are the bulk of the evidence burden, and they are collected manually in a great many organisations — spreadsheets exported quarterly, screenshots, email approvals.

Generating that evidence automatically from the systems themselves reduces audit cost substantially and makes the control more reliable at the same time. It is one of the clearest cases where compliance investment and operational improvement coincide.

Key reports and spreadsheets deserve specific attention, because financial reporting frequently depends on extracts and models outside the main systems. A spreadsheet that feeds a financial statement disclosure is in scope, needs version control and access restriction, and is almost never treated that way — which is why it recurs as a finding.

Where to start

Confirm which systems are genuinely in scope by tracing what affects the financial statements. Scope inherited from a previous year is frequently wider than the current environment justifies.

See ITGC controls for IT teams. GuardsArm runs compliance auditing.