Everything You Need To Know About SOX Compliance
SOX compliance testing is also known as the Sarbanes-Oxyley Act of 2002. This is a U.S. law that protects investors from committing accounting fraud, especially with regards to publicly traded companies. The Act is derived from the names of two congressmen Paul Sarbanes and Michael Oxyle. This law was passed following the rise of accounting scandals in the early 2000s.
After the enforcement of this Act, harsh rules on corporate financial disclosures were passed. The Act also included standards on internal control assessments and corporate governance. Consequently, a Public Company Accounting Oversight Board was established to monitor auditors to ensure they prepare informative, independent, and accurate auditing reports.
SOX’s Expectations From IT Departments
SOX has IT requirements for publicly traded companies. Financial information that is protected by SOX is analyzed and secured in IT systems. The rules on the handling of electronic records are provided under SOX’s Section 802.
The first rule is on the alteration, destruction, and falsification of digital records and the penalties these offenses carry. The second rule states how long records should be stored. All business records need to be stored using the same rules that apply to public accountants. Thirdly, there is a rule on the kind of records that should be kept, including all electronic communications and other business records.
The other Sections that apply to the IT department are Section 302 and Section 404. According to Section 302, a company’s CFO and CEO should certify whether all financial records submitted to the US Securities and Exchange Commission (SEC) are accurate and comprehensive. These officials are charged with analyzing the internal controls of the last 90 days before any reports are submitted.
Section 404 requires companies to conduct an annual audit of their internal controls. These audits need to be conducted by a 3rd party firm. This requirement helps the SEC determine the credibility of the controls.
How To Fulfil SOX’s Rules For IT Departments
When it comes to SOX’s regulations, you should ensure your company monitors, logs, and audits certain conditions and parameters, including:
- Network activity
- Internal controls
- Login activity
- Database activity
- User activity
- Account activity
- Information Access
A SOX audit should focus on four control areas: IT security, access controls, data backup, and change management. Firstly, you need to put controls that prevent data breaches and tools that effectively deal with incidents as they occur. You should also invest in services that secure your financial systems and data from harm’s way.
Secondly, you need to control access to your digital and physical data. If you want to maintain the integrity of your company and keep sensitive information, you need to be particular with your filing cabinets, data center locations, and password controls. For easy control of data, it is essential to classify it. This helps security teams to monitor it easily and enforce policies for handling data. Data should be classified according to sensitivity and the applicable regulations.
Use methods like encrypting, compressing, and saving data in a secure file format. You can also copy data to removable storage devices for added protection. There are also security solutions that can help you protect shared data. These masking features give you only limited access while making sure you comply with accessibility regulations. Sensitive information should be restricted to a small clique of people.
Thirdly, you need to backup all your data. In case of a system error, your financial data may be at risk. However, with efficient backup systems, your financial data is easy to retrieve. Any data centers you use for backing up data are subject to SOX standards, even if they are from third parties or off-site facilities.
Last but not least, it is crucial to have a staff that is familiar with the current demands of financial data security. This is the reason you need to change employers, departments, and positions regularly. You need to make sure you use the appropriate controls for recruiting new staff, buying state of the art equipment or new software, and also changing data infrastructure.
SOX’s Compliance Testing
SOX’s compliance testing has four phases. The first part is known as design testing. This is a walk-through test where transactions are examined from the beginning to the end. For example, hiring employees at your company. This would involve walking through the controls of a person being hired. The walk-through includes checking whether the time logged reflects the hours indicated in their paycheck. All of this information is then traced back to their accounting records. This means showing that your process of documenting controls reflects what you saw when you tested one transaction.
The next phase is called operational effectiveness testing. This test is performed to determine whether your controls work. The aim here is to determine whether that control works as it should. Testing of controls should be done thrice a year. The last test is done at the end of the year to make sure all SOX compliance requirements have been fulfilled. A company should document the results of the operational effectiveness testing.
Generally, the operating effectiveness testing is an internal audit to ensure that all key controls function according to SOX’s requirements. The management should provide affirmative tests that there were no issues or deficiencies with the company’s internal SOX control for financial reporting.
What Are The Penalties Under SOX?
The penalties under section 906 of SOX arise when CEOs and CFOs do not submit financial reports to the SEC. These officials will also be penalized if they do not give a statement certifying that all the information inside these reports is accurate. If any inaccuracies are detected in the reports, those who present them are subjected to dire consequences.
Officials who unknowingly submitted inaccurate or false reports face a fine of up to $1,000,000 or ten-year imprisonment or both penalties. However, those who knowingly submitted inaccurate reports face a fine of up to $5,000,000, or 20 years in prison, or both penalties. Officials found to knowingly fake financial documents also face fines and imprisonment of 20 years or both penalties.
Conclusion Note
SOX controls help secure company data from breaches and also from authorized access. Companies that are SOX compliant have internal policies that ensure the integrity and safety of financial information. The consequences for failing to comply with SOX standards involve vulnerability to cybercriminals and also subject your company to unnecessary losses and penalties. For the sake of your business and your clients, ensure you take all the necessary measures to be SOX compliant.
This post is sponsored by Reciprocity. For more information on the company and its solutions, please visit reciprocitylabs.com. PlanetCompliance only publishes sponsored content from companies whose products and services we think our audience will find valuable or interesting. For additional information about we handle partnerships and content production, have a look at the PlanetCompliance Disclosure Policy, which you can find here.