After a series of fraud violations by high-profile companies, the Sarbanes-Oxley Act or SOX came into effect in 2002 to change how enterprises manage their accounting and disclosure procedures. The idea was to create regulations to protect investors in the US from falling victim to fraudulent accounting practices.
What is SOX?
SOX is a set of accounting and disclosure regulations that determines how publically-traded companies govern, report, and conduct financial affairs. These regulations have been designed to promote a system of internal checks and balances, and to increase transparency.
While SOX compliance is a legal necessity, the security controls inherent to the regulations also help enterprises to protect sensitive data from unauthorized access. In other words, ensuring compliance with SOX makes business-sense because greater internal controls lead to increased protection.
SOX applies to all public companies in the US and any non-US companies that do business in the US. Private organizations and charities don’t need to comply with SOX, unless a private organization is preparing for an initial public offering or IPO.
What are the Penalties for Non-Compliance
Falling foul of the regulations comes with harsh penalties ranging from fines, to removal from public stock exchanges and the voiding of directors and officers (D&O) insurance policies. Individuals who make the decision to submit deliberately incorrect information or destroy company documents are committing a criminal offense. Punishments range from fines of up to $5 million and up to 20 years in jail.
The harsh nature of the punishments means that it is essential for enterprises to make a genuine effort to record accurate accounting information and comply with SOX regulations.
SOX Compliance Checklist
SOX is divided into 11 titles. Each of these titles has different sections with smaller requirements. The information included in each section is too vast to be included here, but you can view the full details here. However, the most important sections to familiarize yourself with are as follows:
- Section 302: Corporate Responsibility for Financial Reports
- Section 404: Management Assessment of Internal Controls
- Section 409: Real-Time Issue Disclosures
- Section 802: Criminal Penalties for Altering Documents
- Section 906: Corporate Responsibility for Financial Reports
Section 302: Corporate Responsibility for Financial Reports
Section 302 specifies the responsibilities that enterprises have for safeguarding data and developing accurate financial reports. This section states that the CEO and CFO have a responsibility to ensure that there exists detailed documentation of financial reports and internal controls.
They must also certify that the information included in an annual or quarterly review is correct and take personal responsibility for all internal controls used to protect sensitive data. They must also have reviewed these controls within the last 90 days.
Section 404: Management Assessment of Internal Controls
Section 404 stipulates that companies have systems in place to provide the necessary data to an independent auditor. It outlines how annual reports should be completed and outlines a requirement to report security breaches.
Section 404 also states that you need the safeguards mentioned in section 302 to be verified by an independent auditor. The independent auditor assesses whether there are any security issues that shareholders need to be aware of.
Section 409: Real-Time Issue Disclosures
Section 409 outlines that enterprises have a responsibility to disclose to the public “Additional information concerning material changes in the financial condition or operations of the issue, in plain English.”
Real-time issue disclosures can be supported by qualitative information and graphical presentations to help the public understand the situation better. The core intent behind this section is for organizations to stay transparent for the public and investors. Information on financial condition must be in clear terms so that it can be easily understood by the reader.
Section 802: Criminal Penalties for Altering Documents
Section 802 includes a variety of data retention and protection guidelines that enterprises need to follow. The type of data that should be stored includes email, EDI, bank statements, invoices, bills, checks, letters, publications, and memos. The section also lists how long these records should be maintained:
| Type of Business Record | Length of Time Required to Retain |
|---|---|
| Employment applications | 3 years |
| Invoices to customers | 5 years |
| Receivable or payable ledgers | 7 years |
| Tax returns | 7 years |
| Contracts and leases | Forever |
| Payroll records | Forever |
| Timesheets | Forever |
| Bank statements | Forever |
The section notes that the alteration, destruction, falsification, or concealment of these records will be met with severe consequences. Individuals who unlawfully interact with business records will be subject to penalties, fines and up to 20 years imprisonment.
Section 906: Corporate Responsibility for Financial Reports
Section 906 requires a written statement from the CEO and CFO declaring that the financial report “fairly presents, in all material respects, the financial condition and results of operations of the issuer.” The section also outlines that there are criminal penalties for failing to produce a report that matches these requirements and potential prison time for those who deliberately attempt to obfuscate information.
The SOX Compliance Audit
Once you’ve implemented measures to comply with the act you will need to do a compliance audit. The audit will be used to assess the suitability of the security measures in place. You are required by federal law to hire an independent auditor to complete the audit.
At the start of the audit the auditor will notify key stakeholders about what will be accessed, and when the audit will take place. It is common for auditors to interview staff to develop a better understanding of who is responsible for what in the workplace.
Auditors will review the internal controls within the company to make sure that sensitive information is being protected. They will check that you are physically securing resources like servers and maintaining general best practices like passwords and lockout screens to further protect devices.
They will also check through your documentation to make sure that you are recording access. For example, if an individual interacts with a database then there should be a record so you can see who made the changes and when.
Software for SOX Compliance
Having the right internal controls and monitoring procedures in place is a vital component of SOX compliance. To make sure that you comply it is advisable to use software platforms that have been designed to comply with SOX regulations. In this section, we’re going to look at some of the top software offerings you can use to monitor SOX compliance.
Our methodology for selecting a SOX compliance tool
We reviewed the market for services that enable you to comply with SOX requirements and analyzed options based on the following criteria:
- Logging of all activities
- Storage of log in a meaningful file and directory structure
- Automated and manual log search facilities
- Data protection in the form of encryption and user identification
- Alerts for suspicious activity or inappropriate data access
- A free trial or a demo option that enables an assessment before buying
- Value for money from a single compliance tool that is offered at a reasonable price
With these selection criteria in mind, we identified a list of system monitoring services that will secure data and watch over activities to block suspicious behavior.
Here is our list of the best SOX compliance tools:
- SolarWinds Security Event Manager EDITOR’S CHOICE A comprehensive SIEM tool that tracks activities by collecting and examining log messages. This software package for Windows Server supports SOX compliance through the enforcement of data security and the preservation of logs for auditing. Get a 30-day free trial.
- ManageEngine EventLog Analyzer (FREE TRIAL) This package collects logs from all around a network and cloud services and it provides a SIEM service and compliance reporting. Runs on Windows Server and Linux and available in the cloud. Start 30-day free trial.
- Workiva This specialized SOX-validated tool focuses on the enforcement of system security so that your business can keep compliant. This is a cloud-based service.
- LogicManager This package offers a library of forms and templates to plan system changes that will enforce and monitor SOX compliance. This is a hosted service.
1. SolarWinds Security Event Manager (FREE TRIAL)
SolarWinds Security Event Manager is an event and log management tool that can be used to monitor for SOX violations. The software can analyze events on devices and applications to scrutinize over user activity. There are built-in report templates designed specifically for SOX regulations. However, users can also generate their own customizable reports if they wish to provide further details about an event.
Key Features:
- SIEM tool
- Log collection
- Log management
- SOX compliance analysis
- SOX reporting
Why do we recommend it?
SolarWinds Security Event Manager is a SIEM system. As this type of tool mines log files for source data, the package also includes a log manager. This service can be used for system activity scans that verify financial data for SOX compliance. So, you can generate SOX compliance reporting with the tool.
SOX report can be produced manually or scheduled for a future date. Scheduling reports ensures that you always have some form of documentation to record events in your infrastructure. Likewise, the log analysis capabilities of SolarWinds Security Event Manager double up to help prevent cyber threats from putting your network offline.
Who is it recommended for?
This is an on-premises package while many rival SIEM systems have been moved to the cloud. So, if your business prefers to host all of its software, this is a good choice. The price of the package makes it more suitable for large businesses than small enterprises.
Pros:
- Log collection, collation, filing, and archiving
- Enterprise focused security tool with a heavy focus on compliance and auditing
- Simple log filtering, no need to learn a custom query language
- Dozens of templates allow administrators to start using SEM with little setup or customization
- Comes with templates specifically for SOX compliance
Cons:
- SolarWinds SEM Is an advanced security product built for professionals, requires time to fully learn the platform
Tools like SolarWinds Security Event Manager are excellent for helping you to maintain documentation and manage user activity. SolarWinds Security Event Manager starts at a price of $4,665 (£3,834). You can download the 30-day free trial version.
EDITOR'S CHOICE
SolarWinds Security Event Manager is our top pick for a SOX compliance tool because it manages SOX requirements within a system-wide security package. While this service implements SOX thoroughly and supplies automated reporting, it doesn’t ignore the rest of your system security requirements. Let this system keep an eye out for intruders and insider threats while you get on with the day-to-day business of managing the IT system. The SEM will alert you if your attention is needed and you can even set up the monitoring service to automatically suspend accounts and block communication with suspicious IP addresses.
Download: Get a 30-day free trial
Official Site: https://www.solarwinds.com/security-event-manager/registration
OS: Windows Server
2. ManageEngine EventLog Analyzer (FREE TRIAL)
ManageEngine EventLog Analyzer is a package of a SIEM tool and a log manager. Between these two systems, the EventLog Analyzer is able to track activity on a system and report on data security and integrity for standards, which include SOX.
Key Features:
- Log collection and consolidation
- Activity auditing
- Compliance enforcement
- SOX reporting
Why do we recommend it?
ManageEngine EvenLog Analyzer is a rival to the SolarWindws system. This package provides threat detection scanning on log files but it also offers an extensive file integrity monitoring service. Among its log management functions, this tool is able to track activity and generate SOX compliance reporting.
The ManageEngine system is able to scan log records as they arrive at the log server and it provides analysis facilities. As well as manual analysis, the system provides pre-set searches and there is one such package for SOX compliance. This lets you see immediately when financial recording practices are diverging from SOX requirements. This provides a way to enforce Section 404 of SOX to ensure correct process controls. The tool also provides SOX reporting which automatically populates report templates with SOX-related statistics from your site.
Who is it recommended for?
This package is available both as software and as a SaaS platform. The software package will run on Windows Server or Linux. There is a Free edition of this package, but it is limited to gathering logs from five sources. The cheapest paid edition receives logs from 10 sources.
Pros:
- Compliance auditing and reporting for SOX
- Can also work for PCI DSS, GDPR, FISMA, ISO 27001 compliance
- Log management
- Security scanning with alerts
Cons:
- SaaS version free trial is only 15 days
The compliance reporting function of EventLog Analyzer is just part of the functionality of this package. It also operates as a SIEM for security monitoring. The software for the tool runs on Windows Server or Linux and you can get a 30-day free trial or 15 days for the SaaS version.
3. Workiva
Workiva is a SOX compliance management tool built to map internal controls. Through a real-time dashboard, the user can monitor data and narrative updates within an enterprise. There is also the option to track the history of changes made to documents. The software maintains data security procedures validated with SOC 1, SOC 2, and FedRAMP to keep your data safe from being compromised.
Key Features:
- Ensure compliance
- Maps system security efforts
- Documents actions
- Produces SOX compliance reports
Why do we recommend it?
Workiva is a compliance platform that provides auditing and reporting tools. The service includes SOX-based tracking, which both checks for deviations from that standard’s working protests and also reports on the financial activities of the company in compliance with SOX. The platform also provides ESG management.
In terms of access controls, you can assign role-based permissions to each user to determine who has access to what information. Those who do have access to sensitive files benefit from integration with Microsoft Office 365 so that they can interact with files without the need to download them.
Who is it recommended for?
Workiva is suitable for both private and public sector organizations that are required to enforce SOX or FedRAMP. The SEC reporting unit in the platform shows that this platform will interest larger businesses that are listed on the stock exchange. The tool can also provide management reports for cost tracking.
Pros:
- Uses a simple yet informative dashboard – great for quick insights
- Supports SOC1/2, as well as FedRAMP
- Offers robust access controls for users, groups, and subnets
- Focuses on simplifying compliance monitoring and solving SOX issues
Cons:
- Would benefit from a free trial
For simplifying internal controls Workiva is an excellent tool. The software is easy to use and gives you a layer of transparency that can protect you during an audit. However, you’ll need to contact the sales team for a quote. You can also request a demo.
4. LogicManager
LogicManager is a SOX management platform designed to help enterprises ensure compliance with SOX regulations. The program allows the user to create to-do lists and view real-time alerts to keep on top of documentation requirements. Information can be viewed in the form of dashboards and reports, with the option to sign-off on information to certify that it has been verified.
Key Features:
- Provides checklists
- Documents security
- SOX reports
Why do we recommend it?
The LogicManager platform provides risk management with particular emphasis on data protection compliance. The service is able to set up a compliance management system on your data and in the case of SOX compliance will examine your financial systems and data stores to enforce reporting requirements.
Reports are customizable so you have complete control over the information you see on the screen. In addition, there is customizable testing with optional sampling and user instructions to make sure that you stay on top of important information.
Who is it recommended for?
LogicManager doesn’t publish its price list, so it is difficult to recommend this service to small businesses or startups on tight budgets. The requirements of SOX apply to larger businesses and this category of company is going to be more interested in the risk management tools of the LogicManager platform.
Pros:
- Enterprise-focused SOX auditing, management, and remediation platform
- Allows sysadmin to create a prioritized list to meet SOX requirements
- Highly customizable reports
Cons:
- May be cost-prohibitive for smaller businesses
There are three main versions of LogicManager available to purchase: Essentials, Professional, and Enterprise. The Essentials version starts at $10,000 (£8,219) per year, Professional starts at $30,000 (£24,658) per year, and Enterprise starts at $150,000 (£123,300) per year. The difference in price depends on the number of users you need to support and the complexity of the use case. You can request a demo here.
SOX Compliance Number One Goal: Transparency!
The burdens of regulatory compliance produce a minefield for many enterprises that aren’t equipped with the right information and processes. It is critical for enterprises to raise their awareness of the requirements of SOX to avoid being left open to legal liabilities.
Complying with SOX comes down to enshrining transparency at the heart of your organization. If you set about creating internal controls to make sure that the information used to fill out a report is reliable, then you can.
