SOX - an overview
Serious financial fraud was never considered a real risk while investing in U.S.-listed stocks until 2001, when energy giant Enron Corporation, which held $63.4 billion in assets, collapsed. It was revealed that the company had been misleading investors for years and the company’s stock price quickly plummeted from $90 to less than $1 per share. It was the largest bankruptcy in US history, followed by a $40 billion lawsuit and imprisonment for the corporation’s executives.
In the aftermath, to enforce stronger regulations on corporate governance, a new US federal law - The Sarbanes-Oxley Act (SOX) - was enacted in 2002 to ensure financial transparency and reduce accounting fraud across publicly traded companies.
The Sarbanes-Oxley Act consists of 11 titles that cover many different governance areas from corporate responsibility, accountability, and internal controls, to penalties for fraud and non-compliance. The U.S. Securities and Exchange Commission (SEC) is in charge of its enforcement with oversight authority over the Public Company Accounting Oversight Board (PCAOB) - “a nonprofit corporation established by Congress to oversee the audits of public companies in order to protect investors and further the public interest in the preparation of informative, accurate, and independent audit reports”.
Who must comply with SOX?
SOX applies primarily to the following entities:
-
Publicly traded U.S. companies
-
Publicly traded foreign companies that do business in the U.S.
-
Accounting firms that are responsible for auditing SOX-compliant businesses
Also, private companies planning to go public should be prepared to comply with SOX prior to entering the U.S. stock market.
These companies are subject to an annual audit, during which they are obligated to submit financial reports and prove the accuracy and security of their financial data. It requires all financial reports to include an Internal Controls Report assessed by an independent auditor.
However, in 2019, the SEC proposed amendments to relax requirements for smaller reporting companies (SRC). Under the proposal, companies with less than $100 million in revenues are not required to obtain an audit of Internal Controls over Financial Reporting (ICFR) from an independent auditor.
What fines and penalties can result from non-compliance?
Corporate management is personally accountable for non-compliance. For CEOs and CFOs, fines are defined as up to 5 million dollars and imprisonment for up to 20 years. Also, there is a risk of being de-listed from the stock exchange for companies that fail to comply with SOX.
SOX requirements and IT controls
As a high-level regulation, the Sarbanes-Oxley Act does not stipulate any IT requirements directly. But since financial data is stored and processed electronically, SOX has a huge effect on corporate IT infrastructures, systems, and processes.
Across many sections of SOX, these are considered to be the most important in terms of IT:
-
Section 302: Responsibility for Financial Reports (civil provision)
-
Section 401: Disclosures in Periodic Reports
-
Section 404: Assessment of Internal Controls
-
Section 409: Real-Time Issuer Disclosures
-
Section 802: Penalties for Altering Documents
-
Section 902: Conspiracies to Commit Fraud
-
Section 906: Responsibility for Financial Reports (criminal provision)
Section 404 is the most complicated and expensive one to be accomplished as it requires actual internal controls (ICFR) to be implemented to ensure financial data is protected. It may also require an external audit to attest controls are appropriate and correct.
Internal controls typically span all infrastructure, including workstations, servers, software, and other devices used to process and report financial data. So, ICFR assessment is often the largest and most complex part of SOX audit.
SOX auditors rely on IT frameworks (e.g. COBIT) to benchmark the level of IT governance and investigate four common elements:
-
Access controls: A company must ensure sensitive information can only be accessed by users with permission to do so. A company must ensure it tracks who has access to what data and systems.
-
Security controls: A company must ensure policies and tools are implemented to prevent security breaches against systems used for financial data processing.
-
Change management: A company must ensure it has processes enforced for account, hardware, and software change management (know who and what made a change, and when).
-
Data backup: A company must ensure financial and other sensitive data is retained appropriately.
While SOX compliance was initially aimed at financial transparency, it is increasingly about the controls, policies, and procedures enabled by a public company to ensure that data is correct and protected sufficiently. And the reason is fairly simple: financial controls themselves make sense only if you keep track of system access and who tampers with data.
How long should data be retained?
SOX Sections 103 (a) and 801 (a) require public companies and registered public accounting businesses to maintain audit trails for at least seven years.
During the audit, it is not enough to submit a report stating appropriate internal controls are in place. Companies must be capable of promptly getting evidence the auditor needs and demonstrating compliance with the SOX regulations. Companies must not just log data securely, but also make this data available on demand.
How can NXLog help with SOX compliance?
Security observability and log management play crucial roles in SOX compliance, as it provides an audit trail of access to sensitive data and helps to detect breaches almost in real time.
According to Sections 302, 404, and 409, companies have to log and monitor many actions occurring across IT infrastructure, including:
-
User activity (logon/logoff, privileged access, unsuccessful logon attempts, etc.)
-
Security configuration changes (new users, adding to groups, etc.)
-
Database access (dumping and tampering with its data, etc.)
-
Network activity (terminal sessions to sensitive systems, access to network resources, etc.)
-
Information access (tampering with financial data and critical logs, etc.)
A security observability system must provide an audit trail of all the actions sufficient for timely incident response.
- Simplify processes with unified log collection infrastructure
-
NXLog allows an organization to define a unified log collection mechanism across an entire infrastructure, including system and operational components. Unified log collection helps design comprehensive technical solutions and simplify routines and policies that must be documented and communicated to staff.
- Enable audit log centralization with nothing missed
-
NXLog supports all popular and advanced log data collection methods. It seamlessly integrates with various data sources, including databases, network appliances, SIEM, and APM systems to ensure a SOX-compliant log management process.
- Enable cost-efficient audit log retention
-
According to SOX, audit trails must be retained for seven years—a huge storage capacity problem. NXLog provides log filtration, flexible retention, and routing mechanisms, creating a cost-efficient retention process.
- Enforce audit log & system file monitoring against unauthorized changes
-
NXLog provides a File Integrity Monitoring (FIM) module that detects when files are changed and promptly triggers a security event. This helps to protect both critical system files and retained logs from unauthorized tampering.
The Sarbanes-Oxley Act affects all publicly traded companies in the U.S. with an aim to increase the accountability and integrity of financial reporting. System and application log files enclose crucial information that can be utilized to detect issues and breaches while providing an audit trail for incident response and forensic investigation. Logs are also a fundamental element of SOX Section 404 Internal Controls.
NXLog helps organizations to stay SOX-compliant by providing a centralized security observability solution. Collect and analyze audit logs across disparate systems to aid in real-time threat detection and response, and ensure you always stay compliant with SOX.
