SOX COMPLIANCE DEFINED
After SOX was enacted by Congress in 2002, shareholders and the general public were better protected from accounting errors and fraudulent practices in corporations, and the accuracy of corporate disclosures was improved. Compliance dates and requirements are published in the statute. The legislation was prepared by Congressmen Paul Sarbanes and Michael Oxley in response to the financial crises at Enron, WorldCom, and Tyco, among others.
Every publicly-traded company must now abide by the SOX regulations financially and technologically. Because of SOX, IT teams had to rethink how they keep corporate electronic documents. In addition to defining which records must be kept and for how long, the legislation also specifies which records must be kept and how long they must be kept. Corporations must keep all business documents for “not less than five years” to be in compliance with SOX, which mandates that they do so electronically. Fines and/or jail are possible outcomes of failure to comply.
The ELECTRONIC RECORDS MANAGEMENT THREE RULES
Sox (the Sarbanes-Oxley Act) was a federal law introduced in the United States in 2002 that established new corporate accountability rules to guard against financial scandals like the Enron Corporations.
Through its insistence that members of the public:
1. A complete accounting of one’s finances
2. Consistent rules and regulations.
3. Mandatory disclosure of corporate information
4. Whistleblowers’ rights are protected.
5. Providing information to external auditing bodies
However, several provisions of SOX may also be applicable to charitable organizations and private businesses. For non-compliance, fines and criminal punishments are designed to be punitive.
For finance and IT departments responsible for storing electronic data, SOX has the largest impact on SOX compliance. E-records management is the subject of Section 802’s three specific rules.
- An act of alteration or tampering with records.
- There is a five-year time limit on any record storage.
- All business conversations and related records need to be kept in a safe place.
For SOX, IT departments are responsible for producing and maintaining an archive of company records, which they are required to do. They’re looking for ways to do this that are both cost-effective and in full conformity with the law. E-records management is regulated by three rules under Section 802 of SOX.
The first rule deals with the consequences associated with destroying, altering, or falsifying records.
If you’re going to keep records, you’re going to have to keep them for an extended amount of time. This is a second rule.
In the third rule, all company records, communications, and electronic communications are required to be kept in a secure location.
SECURITY AND COMPLIANCE MANAGEMENT
Having the right security measures in place to ensure accurate financial data and protection against loss is a good strategy for SOX compliance. SOX compliance and management costs can be reduced by implementing best practices and utilizing relevant tools.
Automatically identifying and classifying data as soon as it is created and assigning persistent classification tags is a frequent practice in managing compliance issues. context-aware solutions are able to categorize and tag sensitive information such as PHI and PII and other structured and unstructured data that is regulated, such as electronic health records, cardholder data, confidential design documents, and social security numbers.
THE SOX ACT, SECTION 906
Under Section 906 of the SOX Act, the CEO and CFO are required to submit a written explanation of their findings (CFO). A periodic report, as well as this statement, are both required by law. Sec. 906 states that “the content of the written statement shall certify that the periodic report containing [the financial statements] fully complies with the requirements of section 13a) or 15d) of the Securities Exchange Act of 1934” and “that information contained in the periodic report fairly presents, in all material respects, the financial condition and results of operations of [the issuer]”
Section 906 has a paragraph “(c)” where penalties are listed. Both parties are subject to these fines.
Intentionally or unintentionally certifying a report that does not “comply” with the section 906 requirement
Intentionally signing off on a report that does not “comply” with the mandate in section 906 of the Code of Federal Regulations.
Knowingly violating this rule can result in a punishment of “not more” than $1 million or in prison time of “not more” than 10 years, but not both. A “not more than” $5,000,000 fine or a sentence of 20 years in prison, whichever comes first, is the penalty for a willful violation.
PROTECTION OF PERSONAL INFORMATION AND COMPLIANCE WITH LAW
It is much easier to monitor and enforce corporate data handling policies with the help of data classification. In some cases, sensitive data must be encrypted, compressed, or kept in a different file format depending on existing requirements. Unauthorized users, even those with administrative credentials to the system, can’t access-controlled data if the necessary policies are in place. Removable storage devices can also be used to restrict data egress. The ability to protect shared data is another aspect of security systems that are worth the cost. Access to the relevant information can be ensured while complying with legislation using these so-called “masking” features.
Audits of SOX Compliance
Without the proper security measures in place, it is nearly hard to meet SOX and other regulatory criteria. Providing proof of compliance is much more difficult since it must demonstrate that written controls have been implemented, communicated, and enforced while also supporting non-repudiation. All of your compliance efforts will be validated if you’re using the right security software.
Compliance software should be able to monitor data, enforce policies, and log every user’s actions.. All the data required for compliance is in place because of the evidentiary quality of the trails. Ensure SOX compliance for your firm and your data with a software solution, and you may relax a little more when it comes time for your next audit.
