Sarbanes-Oxley Act
U.S. federal law mandating internal controls and audit trails for financial reporting systems in publicly traded companies. Criminal penalties for executives who certify false statements.
What SOX draws on
This framework pulls on all three pillars — which is why running them as three separate tools means reconciling three sets of evidence at audit time.
Compliance
Security
What your auditor cites,
and what produces the evidence
The regulator's text is quoted below in italic, exactly as written. What follows each one is what the platform records, detects, or proves — not a claim about your compliance status, which no tool can confer.
Corporate Responsibility
CEO and CFO MUST personally certify financial reports. REQUIRES verifiable audit trails proving data integrity.
A requirement like this is about the record surviving the person who would rather it did not, which means the audit trail has to be protected as carefully as the data. File activity monitoring hashes the datafiles, the transaction logs, the backups, and the audit trail itself with XXH3, then baselines them — so an alteration or a deletion is evident rather than inferred, and it is attributed to the session and OS user behind it. Because the same platform holds the query trail, a destructive statement and the file-level change it produced are two views of one event rather than two investigations.
Internal Controls
Companies MUST assess and report on internal control effectiveness. REQUIRES documented evidence of controls over financial data.
Framework audits do not ask whether you own a tool; they ask you to demonstrate that a named control operated over a period. Access reviews, privileged activity, change monitoring, and audit-log integrity are produced from the activity already being captured and mapped to the control they satisfy, with dashboards showing posture over the audit window rather than at a single point. Our evidence-pack engagement formats it the way assessors expect and answers the database-controls questions on the call.
Criminal Penalties
Knowingly altering or destroying records is a federal crime. REQUIRES tamper-evident audit logging.
A requirement like this is about the record surviving the person who would rather it did not, which means the audit trail has to be protected as carefully as the data. File activity monitoring hashes the datafiles, the transaction logs, the backups, and the audit trail itself with XXH3, then baselines them — so an alteration or a deletion is evident rather than inferred, and it is attributed to the session and OS user behind it. Because the same platform holds the query trail, a destructive statement and the file-level change it produced are two views of one event rather than two investigations.
The audit trail is hashed and baselined alongside the datafiles it describes, so altering the evidence is itself an evidenced event.
Audit Documentation
Audit records MUST be retained for 7 years. REQUIRES long-term, immutable log storage.
A requirement like this is about the record surviving the person who would rather it did not, which means the audit trail has to be protected as carefully as the data. File activity monitoring hashes the datafiles, the transaction logs, the backups, and the audit trail itself with XXH3, then baselines them — so an alteration or a deletion is evident rather than inferred, and it is attributed to the session and OS user behind it. Because the same platform holds the query trail, a destructive statement and the file-level change it produced are two views of one event rather than two investigations.
What SOX covers
This instrument defines no data category of its own. Regulates the reliability of the financial reporting PROCESS, not a class of data. What comes into scope is whatever feeds a financial statement assertion, which is decided by the control narrative rather than by a definition. 18 U.S.C. Sec. 1520 separately reaches audit workpapers as records.
How SOX is enforced
Every figure below is the ceiling the instrument publishes about itself, not a prediction of what anything would cost. Enforced by The SEC civilly; the Department of Justice criminally.
| Published maximum | Charged | As at |
|---|---|---|
| USD 5 million | for a wilful false certification under Sec. 906, alongside up to 20 years | 2026-08 |
SOX is the clearest case on this page of an instrument that reaches a person rather than a balance sheet. Section 906 attaches criminal liability to the certification the CEO and CFO sign personally. Section 802 and the obstruction provisions add a separate 20-year exposure for destroying or altering records, which reaches anyone, not only officers.
The certification offences turn on state of mind. Knowing and wilful are different thresholds carrying different maximums.
Who is personally on the hook
- Who can be charged
- The CEO and the CFO, by name, on their own certification — and, separately, anyone who alters, destroys, or conceals a record to impair an official proceeding
- For what
- certifying a periodic report knowing it does not comply — and, separately, altering, destroying or concealing a record to impair an official proceeding
- Maximum
- Certification: up to USD 1 million and 10 years for a knowing false certification, rising to USD 5 million and 20 years where it is wilful. Records: up to 20 years
- Brought by
- The US Department of Justice
Uncapped exposure that sits outside this instrument
These come from company law rather than from SOX, and they are not penalties — they are liability for a loss, which is why nothing caps them at a published maximum.
Duty of oversight
Delaware, and followed in most US corporate jurisdictions. It is a rule of company law, not of any privacy or security statute.
Triggered by. A sustained or systematic failure by the board to establish a reporting system for a mission-critical risk — or, having one, consciously disregarding what it reported. The second limb is what a documented, unremediated finding goes to.
Who. Directors, in their personal capacity, in a derivative action brought on behalf of the company.
This is liability for the loss the company suffered, not a statutory penalty, so nothing caps it at a published maximum. A bad-faith finding also takes the conduct outside the exculpation and indemnification the charter would otherwise provide.
In re Caremark Int’l Deriv. Litig. (Del. Ch. 1996); Marchand v. Barnhill (Del. 2019); In re Boeing Co. Deriv. Litig. (Del. Ch. 2021).
Who the instrument makes accountable
Sections 302 and 906 place the certification on the CEO and the CFO by name. There is no provision for delegating it, which is the point of the section.
The insurance position
D&O policies generally respond to defence costs for securities claims, but wordings commonly exclude fines and penalties, and a final adjudication of deliberate fraud typically triggers the conduct exclusion.
How this class of policy is commonly written. Only your own policy answers what it covers.
Enforcement data reviewed August 2026. Several figures are indexed annually and move.
Built for SOX,
not configured for it afterwards
Financial Data Change Tracking
Monitor all INSERT, UPDATE, DELETE on financial tables
Privileged User Monitoring
Track DBA and admin access to financial systems
SOX Audit Evidence Report
7-year audit trail with tamper-evident verification
Schema Change Detection
Immediate alerts on DDL changes to financial database objects
Other Financial frameworks
Walk into the SOX audit knowing the answer
228 cited requirements across 57 frameworks are mapped to the controls that evidence them. A fixed-fee gap assessment tells you which of them you can already prove today.