When a customer asks "are you SOX compliant?", answer in three parts: whether SOX applies to your company, whether your systems touch the customer's financial reporting, and what IT controls evidence you can share. Do not say "compliant" unless it is true and documented. SOX is about internal control over financial reporting, not a product badge.
We could not open the SEC or PCAOB pages, so the description of SOX here comes from consultancy summaries found by search. Treat this as a drafting aid and have your finance lead and counsel approve wording.
What does the customer usually mean?
Per the summaries, Section 404 has management of public companies assess internal control over financial reporting each year, and for larger companies the auditor attests to that assessment. IT general controls support that, covering access, change management and operations of the systems financial reporting depends on.
A customer who is a public company may need assurance about vendors whose systems feed their financial statements. A billing platform or an expense system fits. A developer tool usually does not. So the real question is often: "does your service sit in the path of our financial reporting, and can you show your controls are sound?"
How to answer each variant
"Is your company subject to SOX?" Answer yes or no. If you are private, say so. If you are public, say it plainly and point to your filings.
"Are you SOX compliant?" Rephrase before answering: "SOX applies to public companies' financial reporting. Here is how our IT general controls work, and here is what we can share." Never write "SOX certified." There is no SOX certification.
"Do you support our SOX audit?" Say which controls evidence you can provide: access reviews, change records, uptime and incident history, and any independent assurance reports you hold. Only list reports you actually have in hand.
What to attach
Keep a small standard pack ready.
- A one page description of how you manage access to production: joiners, leavers, privileged roles and review frequency.
- A description of how changes reach production: review, approval and testing.
- Backup, restore and incident handling summaries.
- Software inventory practice, such as SBOMs per release and how vulnerabilities are tracked.
- A list of independent reports you hold, with dates, and nothing you do not.
The sources we read describe auditors sampling access provisioning and termination events and testing change tickets, so a pack that makes those samples easy to pull will answer many follow up questions.
Keep claims accurate
Questionnaires are contracts in miniature. Wrong answers can create liability and trust damage later. Use these habits.
- One owner approves each answer, with a date.
- Reuse approved answers from a library, and update the library when something changes.
- If you do not know, say "we will confirm" and then do.
- Avoid superlatives and avoid implying a certification you do not hold.
- Mark "in progress" items as in progress.
Where software supply chain fits
Customers increasingly ask how you track dependencies and vulnerabilities. A current SBOM and scan history is a concrete answer. Safeguard builds SBOMs and scans dependencies, and it has compliance automation, but we do not claim SOX coverage and no tool answers the SOX question for you. For Safeguard's own statements, see its compliance documentation, which describes what is in progress and what is not held.
What to do
- Decide whether SOX applies to you and write one sentence for it.
- Build the standard evidence pack above.
- Draft approved answers for the four questions in this post.
- Have finance or counsel sign off on the wording.
- Refresh the pack twice a year and after any control change.
Quick check
Is there such a thing as SOX certification?
No. SOX is a law about financial reporting controls. Auditors test controls, and no certificate is issued to a vendor.
What if we are a small private vendor?
Say so and offer your IT controls evidence anyway. Many customers only need to see sound access, change and incident practices.
Sources
- BD Emerson: SOX 404 compliance, found by search 18 October 2026
- Presencis: Sarbanes-Oxley IT compliance, found by search 18 October 2026
- Safeguard documentation: Compliance, fetched 18 October 2026
Last reviewed: 18 October 2026.
