SOX Compliance

The Sarbanes-Oxley Act (SOX) establishes requirements for financial reporting and internal controls for publicly traded companies. Software systems that process, store, or transmit financial data must support SOX compliance requirements.

SOX Overview

Key Sections

IT General Controls (ITGCs)

┌─────────────────────────────────────────────────────────────────────────────┐
│                        IT GENERAL CONTROLS                                   │
└─────────────────────────────────────────────────────────────────────────────┘

┌─────────────────┐   ┌─────────────────┐   ┌─────────────────┐
│ Access Controls │   │ Change Mgmt     │   │ IT Operations   │
│                 │   │                 │   │                 │
│ - User access   │   │ - Change control│   │ - Job scheduling│
│ - Auth methods  │   │ - Testing       │   │ - Backup/restore│
│ - Privileged    │   │ - Approvals     │   │ - Monitoring    │
│   access        │   │ - Documentation │   │ - Incident mgmt │
└─────────────────┘   └─────────────────┘   └─────────────────┘

┌─────────────────┐   ┌─────────────────┐
│ Program Dev     │   │ Computer Ops    │
│                 │   │                 │
│ - SDLC process  │   │ - Physical sec  │
│ - Code review   │   │ - Environmental │
│ - Testing       │   │ - DR planning   │
│ - Deployment    │   │ - Capacity mgmt │
└─────────────────┘   └─────────────────┘

Access Control Requirements

Segregation of Duties

┌─────────────────────────────────────────────────────────────────────────────┐
│                     SEGREGATION OF DUTIES MATRIX                             │
├─────────────────────────────────────────────────────────────────────────────┤
│ Function              │ Developer │ Tester │ DBA │ Operations │ Security   │
├───────────────────────┼───────────┼────────┼─────┼────────────┼────────────┤
│ Develop code          │     ✓     │   -    │  -  │     -      │     -      │
│ Test code             │     -     │   ✓    │  -  │     -      │     -      │
│ Deploy to production  │     -     │   -    │  -  │     ✓      │     -      │
│ Modify DB schema      │     -     │   -    │  ✓  │     -      │     -      │
│ Approve changes       │     -     │   -    │  -  │     -      │     ✓      │
│ Review access         │     -     │   -    │  -  │     -      │     ✓      │
└─────────────────────────────────────────────────────────────────────────────┘

User Access Management

// Access request and approval workflow
interface AccessRequest {
  requestId: string;
  requestor: string;
  targetUser: string;
  accessType: 'application' | 'database' | 'infrastructure';
  role: string;
  justification: string;
  startDate: Date;
  endDate?: Date;  // For temporary access
  status: 'pending' | 'approved' | 'denied' | 'revoked';
}

interface AccessApproval {
  requestId: string;
  approver: string;
  approverRole: 'manager' | 'data_owner' | 'security';
  decision: 'approve' | 'deny';
  comments: string;
  timestamp: Date;
}

// Quarterly access review
interface AccessReview {
  reviewId: string;
  reviewPeriod: string;
  reviewer: string;
  users: {
    userId: string;
    currentAccess: string[];
    appropriateAccess: boolean;
    action: 'retain' | 'modify' | 'revoke';
    justification: string;
  }[];
  completedDate: Date;
  attestation: string;
}

Change Management

Change Control Process

┌─────────────────────────────────────────────────────────────────────────────┐
│                        CHANGE CONTROL WORKFLOW                               │
└─────────────────────────────────────────────────────────────────────────────┘

┌──────────┐   ┌──────────┐   ┌──────────┐   ┌──────────┐   ┌──────────┐
│ Request  │──▶│ Approve  │──▶│ Develop  │──▶│  Test    │──▶│ Approve  │
│ Change   │   │ (Manager)│   │          │   │          │   │ (CAB)    │
└──────────┘   └──────────┘   └──────────┘   └──────────┘   └──────────┘
                                                                  │
                                                                  ▼
┌──────────┐   ┌──────────┐   ┌──────────┐   ┌──────────┐   ┌──────────┐
│  Close   │◀──│ Verify   │◀──│ Deploy   │◀──│ Approve  │◀──│ Schedule │
│          │   │          │   │(Ops only)│   │ (Owner)  │   │          │
└──────────┘   └──────────┘   └──────────┘   └──────────┘   └──────────┘

Change Request Documentation

## Change Request: CR-2024-0123

**Title:** Update payment processing module
**Type:** Enhancement
**Priority:** High
**Requested By:** Finance Team
**Request Date:** 2024-01-15

### Description
Update payment processing to support new payment gateway API version 3.0

### Business Justification
Current API version 2.0 will be deprecated on 2024-06-01

### Risk Assessment
- **Impact:** High (affects all payment transactions)
- **Likelihood:** Medium (thorough testing planned)
- **Risk Level:** Medium

### Test Plan
1. Unit tests for new API integration
2. Integration tests with sandbox environment
3. UAT with Finance team
4. Performance testing

### Rollback Plan
Revert to API version 2.0 configuration, restart services

### Approvals
| Role | Name | Date | Decision |
|------|------|------|----------|
| Manager | John Doe | 2024-01-16 | Approved |
| Data Owner | Jane Smith | 2024-01-17 | Approved |
| CAB | Weekly Meeting | 2024-01-20 | Approved |

### Deployment
- **Scheduled:** 2024-02-01 02:00 UTC
- **Deployed By:** Operations Team
- **Verified By:** QA Team
- **Closed:** 2024-02-01

Audit Trail Requirements

Financial Transaction Logging

interface FinancialAuditEntry {
  entryId: string;
  timestamp: Date;

  // User context
  userId: string;
  userName: string;
  userRole: string;
  ipAddress: string;

  // Transaction details
  transactionType: 'create' | 'modify' | 'delete' | 'approve' | 'post';
  entityType: 'invoice' | 'payment' | 'journal_entry' | 'account';
  entityId: string;

  // Change details
  previousValues?: Record<string, any>;
  newValues?: Record<string, any>;
  amount?: number;
  currency?: string;

  // Approval chain
  approvers?: {
    userId: string;
    role: string;
    timestamp: Date;
    decision: string;
  }[];
}

// Ensure audit trail integrity
class ImmutableAuditLog {
  private hashChain: string = '';

  async append(entry: FinancialAuditEntry): Promise<void> {
    const entryWithHash = {
      ...entry,
      previousHash: this.hashChain,
      hash: await this.computeHash(entry),
    };

    // Write to append-only storage
    await this.storage.append(entryWithHash);

    // Update hash chain
    this.hashChain = entryWithHash.hash;
  }
}

Retention Requirements

Control Testing

Control Test Matrix

Evidence Collection

# Automated evidence collection
evidence_collection:
  schedule: quarterly

  access_controls:
    - user_listing_with_roles
    - new_user_approvals
    - terminated_user_verification
    - privileged_access_review

  change_management:
    - change_tickets_with_approvals
    - deployment_logs
    - code_review_records
    - test_results

  operations:
    - backup_completion_logs
    - restore_test_results
    - monitoring_alerts
    - incident_tickets

  output:
    format: pdf
    storage: secure_archive
    retention: 7_years

Application Controls

Input Controls

// Validation for financial data entry
interface FinancialInputValidation {
  // Range checks
  validateAmount(amount: number, min: number, max: number): boolean;

  // Format checks
  validateAccountNumber(account: string): boolean;

  // Existence checks
  validateAccountExists(accountId: string): Promise<boolean>;

  // Authorization checks
  validateUserCanPost(userId: string, amount: number): Promise<boolean>;

  // Duplicate checks
  validateNotDuplicate(transaction: Transaction): Promise<boolean>;
}

// Three-way match for invoices
async function threeWayMatch(
  purchaseOrder: PurchaseOrder,
  receipt: GoodsReceipt,
  invoice: Invoice
): Promise<MatchResult> {
  const tolerancePercent = 0.02; // 2% tolerance

  const poAmount = purchaseOrder.totalAmount;
  const receiptAmount = receipt.receivedAmount;
  const invoiceAmount = invoice.totalAmount;

  // Check quantities match
  if (receipt.quantity !== purchaseOrder.quantity) {
    return { matched: false, reason: 'Quantity mismatch' };
  }

  // Check amounts within tolerance
  const amountVariance = Math.abs(invoiceAmount - poAmount) / poAmount;
  if (amountVariance > tolerancePercent) {
    return { matched: false, reason: 'Amount exceeds tolerance' };
  }

  return { matched: true };
}

Processing Controls

• Batch totals and control totals
• Sequence checking
• Limit checks
• Reasonableness tests
• Reconciliation procedures

Output Controls

• Report distribution lists
• Sensitive report encryption
• Output validation
• Error report review

Compliance Checklist

IT General Controls

• ☐ User access management documented
• ☐ Quarterly access reviews conducted
• ☐ Segregation of duties enforced
• ☐ Change management process followed
• ☐ Emergency change procedures documented
• ☐ Backup and recovery tested
• ☐ Incident management procedures documented

Application Controls

• ☐ Input validation implemented
• ☐ Processing controls documented
• ☐ Output controls in place
• ☐ Interface controls documented
• ☐ Reconciliation procedures established

Documentation

• ☐ IT policies documented
• ☐ Procedures documented
• ☐ Control matrices maintained
• ☐ Evidence retained per policy

Related Resources

• Guidelines Overview
• Security
• Observability
• PCAOB Auditing Standards

Compliance

This section fulfills ISO 13485 requirements for control of records (4.2.4) and internal audit (8.2.2), and ISO 27001 requirements for access control (A.5.15), logging and monitoring (A.8.15), change management (A.8.32), and audit logging (A.8.15).

View full compliance matrix