The Sarbanes-Oxley Act of 2002 (SOX) is a US law that makes public company executives certify their financial reports and requires management to assess internal controls over financial reporting. IT matters because the systems that produce those numbers must be controlled, access limited and changes tracked.
What does the law actually say?
SOX is Public Law 107-204. It created the Public Company Accounting Oversight Board (PCAOB) in section 101 to oversee audits of public companies. Most security teams meet it through a handful of sections.
Section 302 requires the principal executive and financial officers to certify each periodic report. Among the certifications, the signing officer states they have reviewed the report and that, on their knowledge, it does not contain untrue statements of material fact.
Section 404 requires an annual internal control report. Management states its responsibility for an adequate internal control structure for financial reporting and assesses its effectiveness as of year end. The company's external auditor attests to that assessment.
Section 802 makes it a crime to knowingly alter, destroy, conceal or falsify records with intent to obstruct an investigation. That is the root of many retention and logging policies.
Section 906 adds criminal penalties for officers who certify a report knowing it does not comply.
Where does IT come in?
The statute does not mention firewalls or passwords. It cares about financial reporting controls. But modern financial reporting runs on applications, databases and spreadsheets, so the controls around those systems become part of the story. Auditors commonly call these IT general controls and group them under access, change management and operations.
Access means only the right people can reach the general ledger, and leavers lose access quickly. Change management means a software change that touches financial calculations is approved, tested and traceable. Operations means backups, job scheduling and incident handling are reliable.
SOX is not a security standard and prescribes no framework. Companies usually choose a control framework to organize the work and document how their controls meet management's objectives.
Constructed example: an invoice approval change
A finance application has a rule that invoices above a limit need two approvers. A developer lowers the second approval threshold during a release to fix a bug and the change goes live without review. Nothing malicious happened, but the control that supported accurate reporting changed with no record of who approved it. An auditor testing change management would pick this up, since there is no ticket, no approval and no test evidence.
The fix is dull and effective: require a linked, approved change for anything touching in scope systems, and keep the evidence.
Does SOX apply to every company?
Section 404 reporting applies to companies that file periodic reports under the Securities Exchange Act, which in practice means public companies. Private firms are not directly bound, though some mirror the practices before an IPO, and the criminal provisions on document destruction use broader language. Check with counsel about your own status.
How to check or apply this
- Ask finance which applications and databases are in scope for financial reporting, and write the list down.
- For each, review who has privileged access and when it was last recertified.
- Check that production changes to in scope systems need an approved ticket and that developers cannot push directly.
- Confirm logs and records tied to financial processes are retained and protected from alteration.
- Keep evidence for each control in a place the auditor can reach without a scramble.
Software teams can help by recording dependency and build changes with the same discipline as code changes, which supports change management evidence.
Quick check
Is SOX a cybersecurity law?
No. It targets the accuracy of financial reporting. Security matters because weak IT controls can undermine the reliability of financial data.
Who signs the certification under section 302?
The principal executive officers and principal financial officers, or people performing similar functions, certify each annual or quarterly report.
Sources
Last reviewed: 18 October 2026.
