What is SOX Compliance?
The Sarbanes-Oxley Act of 2002 (SOX) was passed by the United States Congress to protect investors from fraudulent or erroneous financial reporting by publicly traded companies. It applies to companies whose securities are registered with the US Securities and Exchange Commission (SEC), including foreign private issuers, and to their external auditors.
SOX sets requirements for the accuracy and reliability of financial reports and disclosures. Section 404 requires management to assess and report each year on the effectiveness of the company’s internal control over financial reporting (ICFR), and, for larger companies, requires the external auditor to attest to that assessment. Because financial reporting runs on IT systems, this is where IT general controls such as access management, change management and logging come into scope.
Goal
To protect investors by improving the accuracy and reliability of corporate disclosures made pursuant to the securities laws, and for other purposes.
What are SOX Controls?
SOX controls are the internal controls a company puts in place over processes that affect financial reporting. Their objective is to prevent, or detect and correct, material misstatements so that financial reporting is accurate and reliable; protecting the systems and data behind the numbers is part of that.
These controls must cover all business processes and cycles that feed financial reporting or financial results. To support SOX compliance, companies document, test, maintain and regularly review these controls. Most companies use an internal audit or SOX function to test controls throughout the year, although the Act itself places the obligations on management and the external auditor. Management normally evaluates ICFR against a recognised framework, most commonly the COSO Internal Control: Integrated Framework (2013).
SOX Compliance Requirements
The key compliance requirements of SOX come from a handful of sections:
- Senior management responsibility (Section 302): The CEO and CFO must certify each annual and quarterly report filed with the SEC, confirming that it is accurate and fairly presents the company’s financial condition, and that they are responsible for, and have evaluated, disclosure controls. They must also disclose to the auditors and the audit committee any significant deficiencies or material weaknesses in internal controls and any fraud involving management or employees with a significant role in internal control.
- Internal control report (Section 404): Section 404(a) requires each annual report to include management’s statement of responsibility for an adequate internal control structure and an assessment of its effectiveness at year end. Section 404(b) requires the external auditor to attest to that assessment. Non-accelerated filers (including most smaller reporting companies) and emerging growth companies are exempt from 404(b), but not from 404(a).
- Real-time disclosure (Section 409): Companies must disclose to the public, on a rapid and current basis, material changes in their financial condition or operations.
- Record retention (Section 802): Knowingly destroying, altering or falsifying records to obstruct a federal investigation carries up to 20 years’ imprisonment, and auditors must retain audit workpapers (at least five years under the Act; seven years under the PCAOB and SEC rules that implement it).
- Criminal penalties for false certification (Section 906): An officer who knowingly certifies a non-compliant report faces fines of up to $1 million and up to 10 years’ imprisonment; wilful certification raises this to $5 million and 20 years.
- Data security and proof of compliance: SOX does not prescribe specific security technologies, but in practice auditors expect documented security and access policies, communicated to staff and consistently enforced for systems that hold or process financial data, together with evidence that controls were tested and monitored throughout the year.
SOX Audits
The external audit of internal control is performed annually by an independent registered public accounting firm, appointed and overseen by the company’s audit committee (Section 301). For companies subject to Section 404(b), it is conducted as an integrated audit with the financial statement audit under PCAOB Auditing Standard AS 2201, An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements. Management is responsible for preparing documentation and evidence before the audit.
Management assesses ICFR against a framework such as COSO 2013, and many organisations use COBIT to structure their IT general controls. The most extensive IT work in a SOX audit arises under Section 404 and typically examines these areas of the IT environment:
- Access: physical and logical measures that prevent unauthorised access to financial systems and data, including securing servers and data centres, user provisioning and de-provisioning, privileged access, periodic access reviews and strong authentication.
- Security: the staff, practices and tools deployed to prevent and detect security breaches on devices and networks used for financial data.
- Change management: how the organisation approves, tests and deploys changes to software and configuration, and maintains audit trails of those changes.
- Backup and IT operations: how the organisation ensures that financial data that is lost can be restored, including data stored off premises, and that scheduled jobs and interfaces run completely and accurately.
SOX Compliance Checklist
SOX compliance depends on protecting your financial data and keeping the integrity of your financial transactions intact. A checklist helps you formalise the process of achieving SOX compliance in your organisation:
- Prevent data tampering: Implement systems that track logins and detect suspicious login attempts to systems used for financial data.
Document timelines for key activities: Implement systems that apply timestamps to financial and other data relevant to SOX. Store such data in a secure, separate location and protect it (for example with encryption and immutable storage) to prevent tampering.
- Install access controls and track access: Implement systems that collect activity data from relevant sources, including files, file transfers and databases, and track who accessed or modified financial data.
- Test, verify and evidence safeguards for auditors: Produce regular reports on control operation and give auditors read-only access to the evidence they need, so they can view relevant data without being able to alter anything.
- Report on the effectiveness of security systems: Test and validate throughout the year that your security and compliance measures are effective. Have systems and processes in place that collect data about breaches, security incidents and suspicious activity.
- Detect security breaches: Implement monitoring that identifies suspicious activity on all systems relevant to SOX compliance, and that can detect, assess and document threats in near real time and send detailed reports to an incident management system.
- Assess and disclose security incidents: Document security incidents affecting financial systems, record which were mitigated and which were not, and assess whether any indicate a control deficiency. Significant deficiencies and material weaknesses must be disclosed to the auditors and audit committee under Section 302, and material cybersecurity incidents may also need public disclosure under the SEC’s 2023 cybersecurity disclosure rules (Form 8-K Item 1.05).
Sources: Sarbanes-Oxley Act of 2002, Public Law 107-204 (govinfo.gov); PCAOB AS 2201; COSO, Internal Control: Integrated Framework (2013).
Sinevis can help with SOX Compliance
Sinevis can help an organization with the implementation and maintenance of sustainable SOX 404 compliance programs. Our team will work closely with your organisation to establish compliance programs, transfer knowledge and provide training to support a successful SOX 404 compliance program. Our team can help you with:
- IT SOX Readiness & Risk Assessments
- Internal Audit Support & Issue Remediation
- IT Application controls support
- IT SOX Controls Testing & Automation
Please contact us.