Sustaining SOX Compliance: Best Practices to Mitigate Risk, Automate Compliance, and Reduce Costs

Overview

The Sarbanes-Oxley Act (SOX) has significant information security implications for companies governed by the regulation. Sections 302, 404 and 409 of SOX, and corresponding SEC Rules and Regulations, have tremendous ramifications for Information Technology (IT) in the areas of control (internal controls), evaluation (governance, measurement and record keeping), and disclosure (reporting and certification). Perhaps the most talked-about requirements of SOX are the ones related to internal control over financial reporting. Section 302 of SOX and the SEC Regulations that were passed to implement it require corporations to adopt internal controls over financial reporting and operations.