SOX
Also known as: Sarbanes-Oxley, Sarbanes-Oxley Act, SOX compliance, Section 404
SOX (the Sarbanes-Oxley Act) is a US federal law passed in 2002 that imposes strict requirements on public companies regarding financial reporting accuracy, internal controls, and executive accountability.
Section 302 requires CEOs and CFOs to personally certify the accuracy of financial statements. Section 404 requires an annual assessment of internal controls over financial reporting (ICFR), audited by an independent external auditor at larger public companies (smaller reporting companies are exempt from the auditor attestation). SOX was a direct response to accounting scandals at Enron, WorldCom, and Tyco that wiped out billions in investor value.
SOX, explained at three levels
At home
SOX was created after some very large US companies were caught falsifying their financial records, costing investors billions. The law says public companies (those traded on stock exchanges) must keep accurate books, have their internal processes checked by independent auditors every year, and have their CEO and CFO personally sign off that the numbers are correct. Executives who sign off on false statements face fines and prison time.
At work
SOX affects IT organizations primarily through Section 404, which requires companies to assess and have audited the internal controls that protect financial data. IT General Controls (ITGCs) (covering access management, change management, computer operations, and data backup) are tested as part of the SOX audit because financial systems depend on them. External auditors test these controls annually and report material weaknesses or significant deficiencies to the audit committee.
At home
The key SOX sections for IT and compliance teams are: Section 302 (CEO/CFO certification of financial statements), Section 404 (management assessment and auditor attestation of internal controls over financial reporting), and Section 409 (material changes must be disclosed promptly). SOX applies to any company listed on a US stock exchange, including foreign private issuers, and to their subsidiaries if their financials are consolidated into the parent's filings.
At work
IT General Controls tested under SOX Section 404 typically include: logical access controls (who can access financial systems and how access is provisioned and revoked), change management (all changes to financial systems follow a documented, approved process), computer operations (batch jobs complete successfully, errors are monitored), and data backup and recovery (financial data can be restored within defined timeframes). A material weakness requires public disclosure and can significantly impact a company's stock price and audit fees.
At home
The PCAOB's auditing standards require external auditors to use a top-down, risk-based approach: start with entity-level controls, identify significant accounts and disclosures, trace to relevant processes, and test controls most likely to prevent or detect a material misstatement. Automated controls (where a system enforces a rule without human intervention) are generally more reliable than manual controls and require less testing once validated.
At work
From a practitioner standpoint, the most common SOX finding in IT is access control deficiencies: terminated employees with active system access, excessive privileges (developers with production access), or shared service accounts without individual accountability. Segregation of duties (SOD) conflicts (where the same person can initiate and approve a financial transaction) are consistently flagged. Automation of access certification, provisioning workflows, and change management approvals has significantly reduced ITGC testing burden for mature SOX programs.
Real-world examples
At home
Lena bought shares in a mid-size retail chain. When the company later restated its earnings due to an accounting error, Lena suffered losses. SOX's disclosure requirements meant the company was legally obligated to disclose the restatement promptly and investigate the internal control failure: providing Lena with information she could act on.
At work
At Meridian Corp, the IT compliance team ran quarterly user access reviews across all financial systems as part of their SOX program. After automating the review process with an identity governance tool, they reduced the time spent on access certification from three weeks per quarter to two days, and reduced findings at external audit from 12 to zero.
Common confusions
- SOX is often mischaracterized as an IT compliance standard. It is a financial reporting law that creates IT obligations because financial systems depend on IT controls. The goal is accurate financial statements, not IT security for its own sake: IT controls are tested only to the extent they affect the reliability of financial reporting.
- SOX applies only to companies whose securities are publicly traded in the United States and their consolidated subsidiaries. Private companies, non-profits, and government entities are not subject to SOX, although some private companies voluntarily adopt SOX-like controls when preparing for an IPO or because investors require it.
- A clean SOX audit does not mean an organization's IT systems are secure. SOX testing is scoped to financial reporting controls: a system with excellent SOX controls but poor cybersecurity hygiene would pass SOX and still be vulnerable to a breach. SOX compliance and cybersecurity maturity are separate assessments with different scopes.
For analysts
In BA artefacts, SOX requirements appear as constraints on systems that support financial processes: general ledger, accounts payable, payroll, and reporting tools. Changes to in-scope systems must go through the change management controls tested at SOX audit, which typically means stricter approval and documentation requirements. When documenting requirements for a new financial system, flag the SOX scope early: it affects timelines, approvals, and testing requirements. Useful NFR: 'All access to the general ledger must be provisioned through the approved identity governance workflow, with manager and system owner approval, and reviewed quarterly.'
History & origin
SOX was signed into law by President George W. Bush on July 30, 2002, at the peak of a wave of corporate accounting scandals. Enron's collapse in 2001 and WorldCom's $11 billion accounting fraud in 2002 destroyed public confidence in financial reporting. The law created the Public Company Accounting Oversight Board (PCAOB) to regulate auditors, established criminal penalties for executives who knowingly certify false financial statements, and introduced whistleblower protections for employees who report securities violations.