What's Sarbanes-Oxley (SOX) & How Does It Relate to Identity Governance?

What is Sarbanes-Oxley (SOX) and How Did It Highlight The Need for Identity Governance?

In 2002, after a wave of corporate scandals and in the midst of the dot-com crash, new policy controls were introduced requiring US public companies to maintain strict controls over financial reporting, including ensuring that only authorized individuals have access to financial systems.  The requirement for governance over access to financial systems established a major driver for investment in Identity and Access Governance.  

Public companies are audited for compliance with the SOX regulations, requiring audit “proofs” be provided to meet the standards established by the law. 

What are SOX 404 Controls and Why Do They Require Me To Do Access Reviews?

SOX 404 controls refer to the internal control requirements outlined in Section 404 of the Sarbanes-Oxley Act of 2002.  They are designed to ensure the accuracy and reliability of financial reporting and to prevent financial fraud in public companies.  Identity governance helps ensure that the right individuals have the right access to the right resources at the right times, which is fundamental to many SOX 404 controls.

Key components:

1. Internal Control over Financial Reporting (ICFR):

• • Management is responsible for establishing and maintaining adequate internal controls

  • These controls should provide reasonable assurance regarding the reliability of financial reporting

2. Management Assessment:

• • Management must assess the effectiveness of the company's internal controls annually

  • This assessment should be included in the company's annual report

3. External Auditor Attestation:

• • For larger public companies, an external auditor must attest to and report on management's assessment of internal controls

What Are The Types of SOX Controls and How Do They Relate to Identity Governance?

There are five primary types of controls that SOX outlines to accomplish its mission:

Preventive Controls:

Preventative Controls are designed to stop errors or fraud before they occur.

Example: Segregation of duties in financial transactions  ← Role Based Access Controls + SOD Policies

Detective Controls:

Detective Controls are aimed at identifying errors or irregularities after they have occurred

Example: Regular account reconciliations ← Access Reviews and Orphan Account Detection

Corrective Controls:

Corrective Controls are designed to address problems identified by detective controls

Example: Procedures for correcting and re-running erroneous financial reports

Entity-level Controls:

Entity-level Controls are broad controls that impact the entire organization

Example: Company-wide full user access review ← Access Certification

Process-level Controls:

Process-level Controls are specific controls within individual business processes

Example: Approval procedures for the ability to make large expenditures ← Access Request + Role Access Policies

What Are The SOX Access Management Requirements?

• User Access Controls: Verify that user access to financial systems and data is granted based on the principle of least privilege and that access rights are reviewed and approved before being granted.
• Periodic Access Reviews: Ensure that periodic reviews of user access rights are conducted to verify their appropriateness based on current job functions and that remediations are handled promptly
• Termination Remediation: Verify that access rights are promptly revoked when an employee leaves the organization or changes roles.
• Monitoring and Logging: Ensure that all access to financial systems and data is logged and monitored for suspicious activities.
• Authentication Mechanisms: Check that strong authentication mechanisms, such as multi-factor authentication (MFA), are in place to secure access to financial systems and strong password policies are in place
• Audit Trail: Verify that a comprehensive audit trail is maintained for all access changes to financial systems and data.

What Are SOX Access Certification Best Practices?

For SOX access reviews, the recommended best practices for access controls frequency and scope are:

Frequency:

1. Quarterly reviews: This is generally considered the gold standard for SOX compliance.
2. At minimum, semi-annual reviews: This is often acceptable for lower-risk systems or smaller organizations.

Scope:

1. All financially relevant systems and applications
2. User accounts with access to sensitive financial data or processes
3. Privileged accounts (e.g., admin accounts, service accounts)
4. Third-party or vendor accounts

Best practices for the review process include:

1. Comprehensive coverage: Review all user accounts, not just a sample.
2. Risk-based approach: Focus more attention on high-risk systems and privileged accounts.
3. Involvement of business process owners: They should review and certify the appropriateness of access for their area.
4. Documentation: Maintain detailed records of the review process, findings, and actions taken.
5. Follow-up: Ensure that identified issues are addressed promptly.
6. Independence: The reviewer should be independent of the access provisioning process.
7. Use of automated tools: Leverage technology to streamline the review process and improve accuracy.
8. Alignment with changes: Conduct additional reviews after major organizational changes or system implementations.
9. Integration with other processes: Align access reviews with user provisioning/de-provisioning and change management processes.
10. Metrics and reporting: Track key metrics (e.g., number of issues identified, time to resolve) and report results to management.

Different job functions have different focus areas and access to data related to a SOX audit:

What Are The Segregation of Duties (SoD) Requirements for SOX?

• Role Definitions: Verify that roles and responsibilities are clearly defined and documented.
  • Ensure that critical financial tasks are separated among different employees to prevent fraud and errors.
  • Documentation of compensating controls where SoD conflicts cannot be avoided
• Policy Enforcement: Check that SoD policies are enforced through the organization’s systems and processes.
• Review and Approval Processes: Confirm that access requests and changes to roles are reviewed and approved by authorized personnel.
• Conflict Resolution: Document how the organization identifies and resolves SoD conflicts.

How can Clarity Security Help? 

Implementation of these kinds of controls isn’t easy! Clarity Security is here to help.  If your current process is complex or expensive, let our team show you how we can make meeting complex SOX requirements simple.