SOX Compliance

SOX compliance means meeting the requirements of the Sarbanes-Oxley Act of 2002 (SOX). The Act requires public companies to maintain internal controls over financial reporting, have those controls assessed and audited, and have executives certify the accuracy of their financial reports. In practice, IT teams support compliance by securing the systems that store and process financial data, including access control, logging and change management.

Congress passed SOX in 2002 after the accounting scandals of Enron, WorldCom and Tyco, to restore trust in financial reporting. It is named for its sponsors, Senator Paul Sarbanes and Representative Michael Oxley. 

The Act requires the CEO and CFO to sign statements attesting to the accuracy of financial reports, and it increases fines and criminal sentences for fraudulent reporting. The provisions that most affect accounting and IT teams involve designing, maintaining and testing controls over financial reporting, including the controls on the systems and records behind it. 

Who must comply with SOX?

SOX has 11 titles, most of which apply to companies whose securities are registered with the Securities and Exchange Commission (SEC), including foreign companies listed on U.S. exchanges. These companies must establish and maintain internal controls over financial reporting and have them audited. They also have reporting and auditing requirements, including rotating the lead audit partner at their independent accounting firm. Off-balance-sheet transactions must be reported, too.

The goal is annual reports the public can rely on. Reliable, transparent financial statements make U.S. markets more trustworthy and help reduce financial fraud, which is also why SOX compliance helps companies attract investors. 

Nonprofits, privately held companies and accounting firms

Certain SOX provisions also apply to privately held companies and nonprofits. These organizations must comply with provisions that forbid knowingly destroying or falsifying financial documents, and they must cooperate with federal investigations around financial reporting. 

Audit firms that audit public companies must register with the Public Company Accounting Oversight Board (PCAOB) and follow its standards.

Why SOX compliance matters

For companies, SOX gives a baseline for documenting and testing the internal controls that keep financial reporting accurate, including the IT controls on the systems behind it. Controls that are documented early make audits faster and bring IT into the process alongside finance, so the company builds sound processes as it grows instead of retrofitting them. For investors and the public, audited controls and executive accountability make financial statements more reliable.

Compliance is costly, and the burden falls hardest on smaller companies, which have fewer processes to automate. Whether the benefits outweigh the costs is still debated. The requirements apply either way, and companies that treat controls as part of how they operate spend less on audits than those that rebuild evidence every year. 

What are the steps in SOX compliance?

At a high level, SOX requires companies to:

1. provide financial statements, audited by a third party, to the SEC.
2. report material changes to the public.
3. design, implement and test internal controls.
4. compose an annual statement on internal controls and their adequacy, signed by management and audited by a third party.

That third requirement takes the most time for a company that's new to SOX, because it usually means changes to IT systems and processes to secure financial data. 

Internal controls requirements

At the IT level, SOX compliance means managing internal controls in areas such as:

• access control
• cybersecurity
• segregation of duties
• change management
• backup systems

Several frameworks cover these areas. The Committee of Sponsoring Organizations of the Treadway Commission (COSO) Internal Control framework is the most widely used for internal control over financial reporting, and Control Objectives for Information and Related Technologies (COBIT) is often used for the IT controls. Federal agencies and their contractors often work from National Institute of Standards and Technology (NIST) frameworks, and ISO 27001 is the international standard for information security management. (Although no SOX certification exists, SOX compliance does.)

These frameworks give companies a way to link business and IT goals, build controls, set objectives, assign responsibilities and measure performance. 

SOX internal controls audit

Section 404 of the SOX requires management to assess internal controls over financial reporting. For larger companies, it also requires an external auditor to attest to them. Smaller public companies, known as non-accelerated filers, are exempt from the auditor attestation. No single set of SOX controls applies to every organization, so an IT controls audit focuses on each IT area, from access control to backup systems. For example, companies might test internal access management systems when auditing access control and authentication.

An audit starts with a risk assessment to define the scope. The PCAOB's auditing standards help identify the areas where controls are needed. Identify critical controls first, then test that they are designed well, working as intended and operated by the right owner.

SOX key sections

SOX has 11 titles. The sections that most affect businesses implementing SOX are below. 

SOX 302

Corporate Responsibility for Financial Reports

Section 302 requires the CEO and CFO of a public company to certify each periodic financial report filed with the SEC. Both are held responsible for report accuracy. The officers are required to attest that the reports are correct and include all essential information. Companies must have internal controls to prevent erroneous information, and the officers must certify that they evaluated the effectiveness of those controls within 90 days before the report.

SOX 303

Improper Influence on Conduct of Audits

“Materially misleading” statements are at the heart of this section, which forbids misleading, coercing, manipulating or influencing auditors. Doing so can result in civil penalties enforced by the SEC.

SOX 401

Disclosures in Periodic Reports

This section declares that annual and quarterly financial reports filed with the SEC must include material off-balance-sheet transactions, arrangements and obligations, even if those obligations are contingent. The rule makes changes in financial condition, liquidity, capital expenditures and resources visible to investors. Section 401 also stipulates that reports should not contain any misleading statements, let alone untrue statements or errors of fact.

SOX 404

Management Assessment of Internal Controls

Management is accountable for adequate internal controls. Both management and, for larger companies, external auditors report on the adequacy of controls and any gaps. The SEC publishes guidance to help smaller companies assess their internal controls. In practice, Section 404 means teams need evidence that confirms their reports, or they face penalties for false reporting. 

SOX 802

Criminal Penalties for Altering Documents

Employees who make changes to a financial document that can affect the SEC’s administration, or who conceal or falsify a record, are subject to criminal penalties from fines to imprisonment for up to 20 years.

SOX 806

Protection for Employees of Publicly Traded Companies Who Provide Evidence of Fraud

The section protects the employees and officers of a company who knowingly aid an investigation, come forward with information, testify in an investigation, or cause information about a company’s financial fraud to be released. Employees are protected from losing their positions and from harassment, demotion, suspension or any other discrimination. Section 806 outlines compensatory damages for SOX violations.

SOX 906

Failure of Corporate Officers to Certify Financial Reports

Section 906 adds criminal penalties for executives who certify a periodic financial report they know does not comply with the Act's requirements. A knowing violation carries fines of up to $1M and up to 10 years in prison. A willful violation carries fines of up to $5M and up to 20 years in prison.

SOX 1107

Retaliation Against Informants

Further strengthening protections for whistleblowers, this section sets federal criminal penalties of fines or imprisionment of up to 10 years for retaliating against an informant, including any action against their person or employment.

How to prepare for a SOX compliance audit

Advance preparation reduces surprises and the cost of a SOX audit. At a minimum, companies go through five phases:

1. scoping SOX requirements
2. developing and documenting controls
3. implementing controls
4. testing controls
5. conducting an internal audit

The first two phases are time-consuming for newly public companies, and each breaks down into several steps of its own. 

The planning phase of a SOX audit

The planning phase typically covers six steps:

1. Planning for future goals and growth. What accounting processes and controls can scale with the company? A primary benefit of SOX is that it nudges companies to develop methods in both IT and financial systems that support stronger reporting and security as they grow. For example, onboarding and revoking access privileges should not be an overwhelming or manual process, even if automation isn't needed yet. 
   
   
2. Choosing a framework. Familiarize yourself with COSO and COBIT, the frameworks most often used for SOX compliance. ISACA's IT Governance Institute (ITGI) published "IT Controls Objectives for Sarbanes-Oxley," which draws on both and emphasizes IT security controls. Decide which approach suits your company. 
   
   
3. Undergoing a risk assessment. Identify areas in the company subject to SOX compliance. Use the PCAOB's auditing standards to identify risks along with their business impact.
   
   
4. Conducting a gap analysis. Some areas subject to compliance requirements may already have strong controls, while others may not. A gap analysis identifies missing or inadequate controls, so you can prioritize processes with the highest risk and the least coverage. 
   
   
5. Conducting a materiality analysis. In this phase, companies locate material accounts and assess their reporting risk to know where to implement controls. Which items are material to the business's income statement? In other words, which items could influence the financial decisions of investors? What amounts and in which accounts are material?
   
   
6. Conducting a fraud risk assessment. Identify where fraud is most likely to occur, then look for ways to detect it early, reduce the opportunity for it and limit its impact. 

SOX compliance checklist

SOX compliance looks different at every company, but engagements typically begin by identifying where financial data lives, aligning systems with SOX requirements and viewing those systems in the context of business risks and processes. This IT checklist covers the core areas when designing controls:

• Breaches. You can detect a breach in any database, website or storage system, and an incident team is ready to respond, including to ransomware and phishing.
   
• Storage. Records are indexed, searchable and retrievable for the retention period SOX sets for each record type, and the systems and data centers that hold financial data, cloud or on-premise, are covered by controls that fit the risk.
  
  
• Access. Every user has unique credentials, sessions can be traced to a person, access changes when employees change roles or leave, and user access reviews run on a schedule, including for sensitive systems such as your ERP.
  
  
• Reporting. A security tool keeps logs that can be searched and filtered, and the logs are stored with controls that prevent tampering. 
  
  
• Escalating incidents. A detected and logged security incident generates a ticket so it is addressed and resolved. 
  
  
• Segregation of duties. No single person controls a transaction end to end (the person who orders inventory doesn't also receive it), controls deter and detect embezzlement and fraud, and employees understand their roles. 
  
  
• Audit trail. Systems timestamp data changes and user access as they happen. 
  
  
• Backup systems. A documented backup policy exists, restoration is tested quarterly, and you can demonstrate backups are accurate and protected from tampering.

What types of software can assist with SOX compliance?

Dedicated SOX compliance software documents controls, manages control testing and generates audit reports. Access management software secures the company network, limits external access and reduces the chance of unauthorized internal access. Log management tools collect access logs as they're created, provide an audit trail and help system administrators detect threats quickly. File transfer software protects data in transit, for example by letting organizations approve what type of data may be transferred. 

Any of these tools can fall within SOX controls testing when the systems they protect or log hold financial records that feed financial reporting. 

More Compliance Resources:

Blog

Streamlining compliance: The power of broad cybersecurity frameworks