Support your SOX IT controls with less manual evidence work

SOX, the Sarbanes-Oxley Act of 2002, is a US federal law that tightened financial reporting and corporate governance rules for public companies. It requires the CEO and CFO to certify periodic financial reports, requires management to assess internal control over financial reporting each year, strengthened auditor independence and created the PCAOB to oversee auditors of public companies. The SEC enforces it.

SOX applies to companies that file annual and quarterly reports with the US Securities and Exchange Commission, including foreign private issuers with US-listed securities. Private companies are generally not required to comply, but those planning a US IPO build SOX controls in advance, and service providers to public companies are often asked to support their customers' SOX audits with evidence or a SOC 1 report.

Section 302 requires the CEO and CFO to certify in each annual and quarterly report that they have reviewed it, that it is not misleading, and that they are responsible for and have evaluated internal controls. Section 404 requires an annual internal control report in which management assesses the effectiveness of internal control over financial reporting, and in 404(b) an external auditor attests to that assessment for larger filers.

Under Section 906, an officer who certifies a periodic report knowing it does not comply faces a fine of up to $1 million and up to 10 years in prison. Wilfully certifying such a report raises the maximum to $5 million and 20 years. Other sections add criminal penalties for destroying or altering records, and the SEC can bring civil enforcement actions and bar individuals from serving as officers or directors.

No. Every reporting company must include management's internal control assessment under Section 404(a), but the external auditor attestation in Section 404(b) does not apply to companies that are neither accelerated nor large accelerated filers, following the Dodd-Frank Act in 2010. Emerging growth companies are also exempt from 404(b) under the JOBS Act of 2012.

SOX IT general controls are the technology controls that support reliable financial reporting. SOX does not list them itself; auditors and companies typically group them into access to programs and data, program change management, program development and computer operations. Common evidence includes user access reviews, joiner and leaver records, change approvals, segregation of duties and backup and job monitoring logs.

SOX is a legal requirement focused on financial reporting, while SOC 2 and ISO 27001 are voluntary security frameworks. They overlap heavily on IT general controls such as access management, change management and logging, so evidence gathered for SOC 2 or ISO 27001 can often support SOX IT controls. Service organisations usually provide a SOC 1 report, rather than SOC 2, to support customers' SOX audits.

Yes. SOX is supported in OneClickComply today. We collect evidence for SOX IT general controls automatically, monitor those controls continuously and reuse evidence from SOC 2 or ISO 27001. OneClickComply does not perform the Section 404(b) attestation, which must come from your registered public accounting firm.