The Sarbanes–Oxley Act of 2002, Sarbanes–Oxley, Sarbox, or SOX is a regulation created to improve the quality and integrity of financial reporting. It addresses audits, financial reporting and disclosure, conflicts of interest, and corporate governance, so financial and business information is factual and accurate. Its purpose is to avoid accounting scandals like the ones in 1990s stock market.
All US public companies, management, and public accounting firms have to comply with SOX.
SOX introduces strict procedures and requirements for financial reporting. These procedures ensure reliability of publicly reported financial information, as the reports are created according to Generally Accepted Accounting Principles (GAAP) and thus represent the true information and financial state of the company. This prevents potential corporate frauds, undue risks, protects company assets and creates a sound financial environment.
Top management of the company must individually certify the accuracy of corporate financial information. The annual reports are then submitted to independent, external auditors who review the report accuracy. The independent auditors also attest the internal controls for financial reporting, so the company must ensure that adequate controls, including IT, are set and constantly enforced.
Unlike HIPAA and PCI regulations, SOX is not very specific and straightforward when it comes to regulations that address IT. The only section that addresses IT control practices is 404:
“SEC. 404. MANAGEMENT ASSESSMENT OF INTERNAL CONTROLS.
It doesn’t mention network protection, user accounts, access control, data encryption, or monitoring. Although the Section 404 doesn’t clearly state what should be done on a database that stores company accounting data, it represents the request for providing accurate and factual business and financial reports. To guarantee that the reports are based on true data, it’s necessary to verify that the records protected from tampering and modification by an unauthorized person.
To protect data accuracy and integrity, it’s recommended to identify the minimal permissions on data for each employee and deny any privileges above minimal. Once the permissions are set, monitor permission changes to make sure the security rules are enforced. It’s also recommended to audit all activity on all SQL Server instances and databases that contain financial reporting and accounting data.
This is where ApexSQL Audit can help, as it:
Tracks any potential audit tampering
ApexSQL Audit is a SQL Server auditing tool that provides a variety of options for auditing SQL Server events, ensures compliance with policies, and monitors SQL Server security by tracking permission, login and password changes. It has a range of built-in reports, commonly needed for compliance auditing. For more specific requests, custom reports can be created using a drag-and-drop technique.
Audit reports should be created regularly in order to confirm company internal controls are enforced, or diagnose any discrepancy which could lead to failing to comply with SOX.
Once auditing is set properly, it shouldn’t be changed, unless documented. The Audit settings history report shows the auditing setting changes. Unexpected changes should be investigated, as they can lead to incomplete audit trails, and thus threaten data security:
Once the security rules are set, it’s necessary to monitor all changes to permissions and security settings and investigate any undocumented change. The Security configuration history report shows changes on logins, users, and roles:
The Complete audit trail report shows all events that happened on all audited SQL Server instances:
The Access history report shows who accessed what, when and what changes were made:
The Permission changes report shows who, when and how changed the user’s permissions and the permissions granted/denied to SQL Server roles and role membership changes – logins added or removed. This report help tracking whether the users have been granted more than minimal privileges. Any unexpected and unapproved permission changes must be investigated:
The Unauthorized access report shows failed login attempts, when non-existing logins or wrong passwords are used:
The DDL history report shows the users created/deleted on a database, who and when created/deleted them:
The Logon activity history report shows who and when has attempted to logon to the SQL Server instance along with the time, logon attempt status and machine name:
Although SOX compliance regulations don’t specifically address IT departments, it’s clear that financial reporting and accounting data integrity can be achieved only in a secure and well-protected environment. To be compliant with SOX, identify the potential risks, and set security. Then, use ApexSQL Audit to audit and report SQL Server and database events
References:
1U.S. Securities and Exchange Commission A White Paper Proposing Practical, Cost Effective Compliance Strategies
