SOX Compliance: Requirements and Checklist

What Is SOX Compliance?

The Sarbanes-Oxley (SOX) Act of 2002 is a regulation affecting US businesses. It was enacted by Congress in response to several financial scandals that highlighted the need for closer control over corporate financial reporting practices.

Goals: SOX aimed to increase transparency in corporate and financial governance, and create checks and balances that would prevent individuals within a company from acting unethically or illegally.

Applies to: The regulation applies to all public companies based in the USA, international companies that have registered stocks or securities with the SEC, as well as accounting or auditing firms that provide services to such companies.

Penalties: Non-compliance with SOX can lead to millions of dollars in fines or criminal conviction.

Benefits: SOX compliance is not just a regulatory requirement, it is also good business practice because it encourages robust information security measures and can prevent data theft.

In this article:

• Who Must Comply with SOX?
• Primary SOX Compliance Requirements
• SOX Compliance Audits
• SOX Compliance Checklist
• SOX Compliance with the Exabeam SOC Platform

Who Must Comply with SOX?

The following entities must comply with SOX:

• Publicly-traded companies
• Wholly-owned subsidiaries
• Foreign companies that publicly trade and conduct business in the US
• Accounting firms auditing public companies

Accounting firms and auditing

SOX distinguishes between the auditing function and the accounting firm. The firm auditing the books of a publicly held company is not allowed to do this company’s bookkeeping, business valuations, and audits. It is also not allowed to design or implement an information system, provide investment advisory and banking services, or consult on various management issues.

Companies and non-profit organizations

Private companies, non-profits, and charities are not required to comply with all SOX regulations but should never falsify or knowingly destroy financial information. 

Whistleblowers protection

SOX imposes penalties on organizations for non-compliance and those attempting to retaliate against whistleblowers — someone who provides law enforcement information about possible federal offenses. SOX whistleblower protection states that anyone retaliating against whistleblowers may face up to 10 years of imprisonment.

Initial public offerings (IPOs)

Private companies planning their IPO must comply with SOX before they go public.

Payroll system controls

SOX regulates the establishment of payroll system controls, requiring companies to account for workforce, benefits, salaries, incentives, training costs, and paid time off. Additionally, certain employers are required to adopt an ethics program with a code of ethics, staff training, and a communication plan.

Primary SOX Compliance Requirements

The following SOX Compliance Requirements are directly applicable to IT organizations within companies that are subject to SOX regulations, and will affect your information security strategy:

• Section 302 – Corporate Responsibility for Financial Reports — public companies need to file reports of their financial situation with the Security Exchange Commission (SEC). SOX specifies that the CEO and CFO of the reporting organization must sign each report and be held personally accountable for its contents. CEOs/CFOs must attest that each report is truthful, does not omit essential information, that they have put controls in place to ensure this is the case, and validated these controls within 90 days before submitting the report.
• Section 404 – Management Assessment of Internal Controls — SOX makes corporate management responsible for putting in place an internal control structure that is “adequate.” Both management and external auditors need to assess and report on the adequacy of the control structure and report any shortcomings.
• Section 409 – Real Time Issuer Disclosures — if there is a significant change to a company’s financial situation or ability to operate, company officials are responsible for informing their investors and the general public in a timely manner.
• Section 802 – Criminal Penalties for Altering Documents — company officials or others who make any change to a financial document or other material that can affect the SEC’s administration, conceals or covers up such a document, or falsifies an entry, is subject to fines or imprisonment of up to 20 years.
• Section 906 – Corporate Responsibility for Financial Reports — company officials who submit misleading or false financial reports can be subject to fines of up to $5 million and imprisonment of up to 20 years.

SOX Compliance Audits

A SOX Compliance Audit is commonly performed according to an IT compliance framework such as COBIT. The most extensive part of a SOX audit is conducted under section 404, and involves the investigation of four elements of your IT environment:

• Access – physical and electronic measures that prevent unauthorized access to sensitive information. This includes securing servers and data centers, and authentication measures like passwords and lockout screens.
• Security – staff, practices, and tools deployed to prevent security breaches on devices and networks that are used for financial data.
• Change management – how the organization defines new user accounts, performs software updates, and maintains audit trails of any change to software or configuration.
• Backup – how the organization ensures any sensitive data that is lost can be restored, including data stored off company premises.

SOX Compliance Checklist

The following checklist will help you formalize the process of achieving SOX compliance in your organization.

SOX Compliance with the Exabeam SOC Platform

Understanding the requirements of the regulation is only half the battle when it comes to SOX compliance. To achieve compliance effectively, you will need the right technology stack in place. Tools that help gather the right data and set up the security controls and measures required by SOX regulations will help you achieve compliance faster and reduce risks to your organization.

As the leading Next-gen SIEM and XDR, Exabeam Fusion provides a cloud-delivered solution for threat detection and response. Exabeam Fusion combines behavioral analytics and automation with threat-centric, use case packages focused on delivering outcomes. It can help improve your organization’s overall security profile, leaving you better equipped to maintain compliance with regulations such as SOX.