What is SOX

SOX, or the Sarbanes-Oxley Act of 2002, is a significant U.S. federal law enacted in the midst of a series of huge corporate accounting scandals in the early 2000s, including the high-profile cases of Enron and WorldCom. In brief, the law was designed to protect investors by improving the accuracy and reliability of corporate financial reporting for publicly traded companies. In this way, SOX was created to restore public faith in the stock market and corporate governance, by holding company executives accountable for the integrity of their financial statements and internal controls.

To think about SOX in a different way, it is similar to a large rulebook to pin down transparency and accountability in the day-to-day actions of public companies conducting their financial activities and reporting financial information. SOX is not simply about the numbers presented on a financial statement, but also how those numbers are produced through processes and systems. If you're a public company operating in the U.S., or a foreign company operating on a U.S. exchange, SOX compliance is not optional; it is the law.

Major Areas of SOX Compliance

SOX has eleven sections. However, there are several that stand out as impactful and well-known, especially within IT and security professional work and practice.

• Section 302: Corporate Responsibility for Financial Reports - This section mandates that senior management (CEO & CFO) must personally attest to the accuracy of their financial statements. They must also attest that there are effective internal controls in place and they have reported any control deficiencies. SOX regulation puts senior management accountability directly on them!

• Section 404: Management Assessment of Internal Controls - This is the section that many view as the 'heart' of SOX compliance for IT and security. It is the responsibility of management to create and retain appropriate internal controls over financial reporting, and also annually assess the effectiveness of those controls. For this assessment, an external auditor must attest to (confirm) the management's assessment. This is where IT controls become exceptionally important: Identity and Access Management (IAM) and Separation of Duties (SoD), since financial data is typically found within IT systems.

• Section 906: Corporate Responsibility for Financial Reports (Criminal Penalties): This addresses criminal penalties for knowingly signing off on false or misrepresenting a financial statement. Not only could you be fined, but you may also go to jail!

The Importance of SOX Compliance to Security & Governance

Although SOX is primarily a financial regulation, it has made a huge, long-term mark on IT security, data governance, and corporate accountability. The emphasis on internal controls pulls IT security within the discussion since you cannot maintain quality and integrity of financial data/systems without maintaining reasonable security.

So, why is SOX compliance so important to organizations today?

• Safeguarding Financial Data Integrity: SOX is purely about ensuring that the numbers don't lie. This has very thorough controls [Consider: "very thorough controls implemented"] around every possible system/process that touches financial data (transaction through reporting).

• Oversight of Internal Controls: SOX specifically states there must be a rigorous & documented approach inward to internal controls. This means companies are required to establish clearly defined policies, procedures, and technological safeguards, to deter errors and help identify fraud.

• Requires IT Security: Because financial information is mostly processed and stored in IT systems, securing sensitive financial information, and SOX's cybersecurity controls are a firm requirement that is not negotiable. With SOX, cybersecurity controls must include a strong Identity and Access Management (IAM), Privileged Access Management (PAM), Separation of Duties (SoD), logging, monitoring, and consistency in auditing controls to protect the data and manage access.

• Lessens Fraud and Misconduct: By adding accountability, and requiring multiple controls (such as SoD), SOX diminishes an individual's ability to commit fraud and corporate misconduct.

• Increases Investor Confidence: The main point of SOX is for investors. SOX also increases transparency and accountability for a company's records which protects investors and builds trust in financial markets.

• Pushes Governance and Oversight: SOX causes the company to develop stronger corporate governance structures, have a better definition on what role the audit committee plays, and to have a higher level of oversight on the financial reporting process.

• Encourages Audit Readiness: If a company is under the requirements of SOX, it must prepare for annual audits to scrutinize its internal controls. Being under a continuous cycle of audit readiness encourages best practice security procedures and best practice documentation.

• Minimizes Reputational Damage and Legal Liability: The consequences of not complying with SOX can include very steep penalties, including fines, removal from a stock exchange, and criminal charges for executives in the company. The reputational risks are even worse than legal matters that could stem from a company not complying with SOX.

ReShield understands the complex demands of compliance for SOX. Our all-encompassing Identity Governance and Administration (IGA), Privileged Access Management (PAM), and Identity Security Posture Management (ISPM) solutions provide the fundamental access controls you will need to deal with SOX Sections 302 and 404. We help organizations enforce Separation of Duties (SoD), help with Least Privilege Access (LPA), provide audit trails, and have transparency on every human and machine identity that touches sensitive financial data, while ensuring compliance and reducing any risk.