The 2002 Sarbanes Oxley Act (SOX) is a federal law that aims to increase the reliability of financial reporting and protect investors from corporate fraud. It covers publicly traded companies operating in the United States, and also some private companies, as defined in SOX sections 302 and 404. Section 404 of the SOX regulation requires organizations to implement internal controls, to ensure their financial reporting is accurate.
SOX controls, also known as SOX 404 controls, are rules that can prevent and detect errors in a company’s financial reporting process. Internal controls are used to prevent or discover problems in organizational processes, ensuring the organization achieves its goals.
Learn how Pathlock Automates Cross-App SoD & Transaction Monitoring
SOX controls must be applied and verified in all cycles leading to the company’s financial report or financial results. Internal auditors must conduct regular compliance audits to verify that appropriate controls are in place and that they are functioning properly.
The SOX standard does not provide a list of specific controls. Instead, it requires organizations to define their own controls to meet the regulator’s goals. These could include, for example, access control, change management, segregation of duties, cybersecurity solutions, and backup systems.
To better understand the context of internal controls within the SOX standard, here is a brief review of SOX requirements:
In publicly-traded companies, the CEO and CFO are directly responsible for any financial report filed with the Securities Exchange Commission (SEC). Since the CEO and CFO are held responsible, they face severe criminal penalties for violations, including prison time and millions of dollars in fines.
SOX requires organizations to file a report that demonstrates that the management of the company remains responsible for the internal control structure applied to financial records.
To ensure transparency, all material weaknesses must be immediately reported to senior management. Sections 302 and 404 are highly relevant to this aspect of the act:
SOX requires organizations to create and maintain a data security policy that protects the storage and use of all financial information. SOX requires organizations to consistently implement this policy and clearly communicate it to all employees.
SOX requires organizations to create and maintain compliance documentation, which must be provided to auditors upon request. Additionally, organizations are required to continually perform SOX control testing, as well as monitor and measure SOX compliance objectives.
An enterprise’s internal audit and controls testing is generally the largest, most complex, and time-consuming part of an SOX compliance audit. This is because internal controls include all of the company’s IT assets, including computers, hardware, software, and all other electronic devices that have access to financial data.
A SOX IT controls audit focuses on the following areas:
Evaluating how the organization restricts access and implements access control measures, to ensure only the right people can physically and electronically access sensitive financial information. This includes physical access measures like locks and video surveillance for server rooms, and digital measures like authentication and credentials management using an identity and access management (IAM) solution.
Evaluating how the organization identifies sensitive data, protects it against cyberattacks, monitors who is accessing it and how, and detects security incidents. In the event of an accident, the company must be able to take corrective action in a timely and effective manner. This requires dedicated security staff, effective security procedures, and security tools such as a Security Information and Event Management (SIEM) system.
Evaluating how the organization backs up data and key systems to minimize business disruption and data loss in case of a disaster. Both the original systems, and the data center containing backups or standby systems that store financial data, must be compliant with SOX requirements.
Evaluating how the organization manages changes to the IT environment, such as new employees, new computing infrastructure, new software, updates to existing software, and configuration changes. Changes must be recorded and any sensitive changes should be monitored, anomalies should be reported and acted on to prevent security breaches.
The following best practices can help you more effectively implement and audit SOX controls.
According to the PCAOB, it is best to use a top-down approach to assess risks related to SOX controls. Start from financial statements, identify entities related to each statement, and define the controls needed for the important accounts and disclosures related to the statement.
The end goal of a risk assessment is to identify possible risks, existing controls, and whether they are enough to satisfy SOX requirements. If not, the next step is to develop new procedures to implement the missing controls.
Related content: Learn more in our guide to internal control weaknesses
It is critical to determine materiality and to understand the level of controls required for a financial statement to comply with SOX. The following guidelines can help you determine materiality:
It can be tempting to apply a control every time a risk is identified in the risk assessment process. However, this leads to a large number of controls, which can be difficult to implement and enforce and may needlessly impact business operations.
It is advised to limit the number of controls to the minimum necessary, by identifying key controls. A simple way to differentiate key vs. non-key controls is to ask the question: “What risk does this control mitigate, and is the risk low or high?” If the risk is low, the control may not be needed. Use this approach to prioritize your efforts.
In a large enterprise, it is infeasible to implement all controls manually. Differentiate between:
The first two categories fall under the responsibility of the SOX audit team. However, the third category is taken care of by existing ITGC efforts. By identifying this third category, and focusing your efforts on the first two, you can save a significant amount of time in SOX control auditing.
Preparing for a SOX audit can be a stressful, expensive, and time-consuming process, but it doesn’t have to be. Pathlock provides an automated, real-time solution to proving compliance with your internal controls for SOX. Continuous controls monitoring can ensure that you are always tracking your compliance, so there are no major surprises when the audit season comes around.
In today’s modern enterprise, nearly 100% of the financially relevant activity happens in modern applications like SAP, Oracle, Workday, and NetSuite. By connecting directly into your business applications, Pathlock can automatically monitor activity in these applications to surface any violations to controls, and pinpoint and quantify the financial impact of any risks. Internal and external auditors alike trust Pathlock’s reports to prove control enforcement and compliance with regulations.
Financial Impact Prioritization
Pathlock automatically prioritizes your most critical violations by quantifying access risk by tying violations to real dollar amounts of the out-of-policy transactions
Comprehensive Rulebook
Pathlock’s catalog of over 500+ rules, Pathlock can provide out-of-the-box coverage for controls related to SOX, GDPR, CCPA, HIPAA, NIST, and other leading compliance frameworks.
Real-time Access Mitigation
Pathlock allows users to quickly investigate and respond to potential risky transactions by reviewing access, deprovisioning users, forcing 2FA, or even allowing Pathlock to respond intelligently in real-time, terminating suspicious sessions and blocking transactions in real time
Out-of-the-Box Integrations
Pathlock’s out-of-the-box integrations extend workflows to the provisioning and service desk tools you already have in place, such as ServiceNow, SailPoint, Okta, Azure AD, SAP GRC, and more
Lateral SOD Correlation
All entitlements and roles are correlated across a user’s behavior, consolidating activities and showing cross application SOD’s between financially relevant applications
Continuous Control Monitoring
Pathlock identifies the largest risks by monitoring 100% of financial transactions from applications like SAP in real-time, surfacing violations for remediation and investigation
Schedule a demo with our compliance experts to understand how Pathlock can enable you to achieve compliance using fine-grained controls within your ERP applications.
Share