SOX Compliance Requirements and Archiving

SOX (Sarbanes Oxley Act) is important because it changed how publicly traded companies stored and used their data.

It’s a complex act with many intricacies that you need to understand before implementing the right changes to your business to avoid breaking the law.

In this article we’re going over:

• What Sarbanes-Oxley is.
• The 11 pillars of SOX compliance.
• How SOX changed data archiving.
• Most important SOX compliance requirements.
• How data archiving helps you comply with SOX.
• 5-step guide to full SOX compliance.

What Is the Sarbanes-Oxley Act (SOX)

The Sarbanes-Oxley Act is a 2002 United States federal act which protects investors from fraudulent financial reporting.

It’s more commonly known as SOX and was created due to a series of corporate fraud scandals that shocked the U.S. at the time. The biggest for sure was the Enron scandal, which led to the bankruptcy of the Enron Corporation, an energy giant from Texas.

After these scandals, the U.S. desperately needed serious reforms to its business legislation and practices. Enter SOX.

SOX is governed by The Securities and Exchange Commission (The SEC) and:

• Controls corporations’ financial documentation
• Mandates the rules for preservation and proper safe-keeping of electronic documentation (ESI), including email and social media communication data.

Sarbanes-Oxley is a comprehensive and complex legislation with 11 titles, 6 of which are related to data compliance.

Understanding SOX Compliance — 11 Pillars of SOX

Let’s take a look at all 11 elements of Sarbanes-Oxley that affect your compliance strategy.

1. Public Company Accounting Oversight Board (PCAOB)

This element asks for the creation of a central and independent oversight board within public accounting firms providing audit services (“auditors”).

2. Auditor Independence

The second element restricts auditing companies from providing non-audit services, such as consulting, to the same clients.

3. Corporate Responsibility

Title III imposes individual responsibility on senior executives for the accuracy of financial reports.

4. Enhanced Financial Disclosures

The fourth element asks for tighter internal controls for the sake of providing timely reporting of any relevant changes in financial condition.

5. Analyst Conflicts of Interest

This element is focused on the conduct codes for securities analysts, requiring disclosures of any possible conflicts of interest.

6. Commission Resources and Authority

Title VI defines the authority to censure or bar professionals from practice and defines conditions under which such actions can partake.

7. Studies and Reports

This element deals with the effect of consolidation of public accounting firms, aiming to prevent the manipulation of earnings and masking of actual financial conditions.

8. Corporate and Criminal Fraud Accountability

Title VIII describes criminal penalties for manipulation, destruction, or alteration of financial records or other interference with investigations while protecting whistleblowers.

9. White Collar Crime Penalty Enhancement

This element presents failure to certify financial reports as a criminal offense.

10. Corporate Tax Returns

This element obliges the CEO of any company to sign the company tax return.

11. Corporate Fraud Accountability

Finally, the eleventh element recognizes corporate fraud and record tampering as serious criminal offenses and states the penalties for the offenders.

What Changed With SOX?

SOX placed a greater responsibility on businesses to keep accurate financial records, with the main idea being to protect the public and shareholders against all fraudulent practices.

Sarbanes-Oxley compliance means that public organizations have to carefully document and disclose their internal audit controls and have a greater overview of all employee activities.

Although the bill is about preventing corporate fraud, it has huge implications for data preservation and the archival of all enterprise information.

What SOX was aiming to bring to companies is greater market stability and higher security levels.

However, in a practical sense, SOX forced companies to revise the way they handle their internal communication, guarantee sensitive data handling, and provide transparent business operations.

Sarbanes-Oxley accomplishes all of this with a set number of requirements all public organizations need to comply with.

Retain, search, and produce communication records in minutes.

Next-level cloud email archiving is here.

Learn More

SOX Compliance Requirements

Although SOX notoriously lacks specificity in terms of clear guidelines about how organizations should retain records, the management of email is a fundamental element of SOX compliance.

The three most important SOX compliance requirements impose several obligations to publicly traded companies.

They include:

• Section 302 — Mandates senior corporate executives (CEOs and CFOs) to personally certify the accuracy of financial statements and internal controls over financial reporting.
• Section 404 — Requires companies to establish internal controls and reporting methods of financial reports to ensure adequate controls.
• Section 802 — Outlines the types of business records that must be retained, with a mandatory retention period of 7 years.

The last one, Section 802, is the most important in terms of email retention with three important points:

• Section 802(a) — Addresses the unlawful and deliberate alteration, destruction or falsifying of records. To avoid it, organizations need to ensure that the records are kept securely and in an unalterable format, ideally using an email archiving solution.
• Section 802(a)(1) — Outlines the record retention periods for audit and review documents and stipulates the retention of 5 years from the end of the fiscal period. This affects all electronic records like email making it vital to have an email retention strategy in place.
• Section 802(a)(2) — Specifies audit-related documents, encompassing work papers, and materials forming the basis of an issuer’s financial statement review. Given the significance of emails as crucial corporate records, SOX compliance for email retention aligns with these provisions, subjecting it to other regulations within the Act.

These rules gave all the more importance to better data management and data governance to every business that had the obligation to comply with SOX retention requirements.

How Data Governance Makes SOX Compliance Easier

SOX regulations heavily impacted two parts of every organization — its IT department and financial professionals, and how the organization handles data.

The IT department’s crucial role

Consistent, strong, and proactive data governance forms the foundation of SOX compliance as it requires the retention and management of numerous volumes and types of data.

This data must be kept for prolonged periods, which begs the question — who is responsible for your SOX compliance?

The IT department is critical to the success of SOX data retention strategies.

IT departments lead the charge in implementing technology solutions that facilitate SOX compliance and contribute to policy development.

As the volume of SOX-eligible data continues to grow, the inclusion of the IT department in regulatory endeavors becomes imperative.

A holistic approach to SOX compliance

Using a holistic approach to information management and data governance provides major benefits in terms of SOX compliance.

When organizations fully integrate the IT team as a part of the larger business ecosystem and treat it as an asset, as opposed to the traditional strategy of setting IT off in its own sphere, they can fully get everyone involved with compliance projects on the same page.

Today, IT departments lead the implementation of technology solutions that aid in SOX compliance and also play a role in policy development.

The IT department is included in both regulatory efforts and choosing the best archiving software and platforms to effectively and securely manage that information.

Protect your organization from compliance fines and penalties.

Explore secure, next-generation data archiving solutions from Jatheon.

Learn More

5 Steps to Full SOX Compliance

Now that you understand the need for SOX compliance and the importance of data archiving for your organization, let’s see how you can build your strategy.

Understand SOX requirements

The crucial step towards SOX compliance is to understand what your organization needs in its toolset.

Start by assessing all the communication channels your organization is using — email, social media, SMS, Google Meet, MS Teams, Zoom, Bloomberg, WhatsApp, Yammer or others.

Determine how SOX requirements affect each channel and what type of data you need to archive for compliance and for how long.

This will give you a better idea of the technology you should look for and how you will create your data archiving policy.

Assess your technology

In practice, Sarbanes-Oxley forced organizations to revise the way they handle online communication (outbound, inbound, and internal) and ensure proper handling of sensitive digital data.

This means that your archiving technology has to be on par with SOX retention requirements.

Consequently, the logical second step is to turn your attention to your existing archiving solution.

• Look at how you store your data and how secure it is.
• Are you archiving all the necessary data outlined by SOX?
• How do you distribute data in your organization?
• Is your data safe from tampering and deletion?
• Are you equipped to handle ediscovery?
• Are you satisfied with how the solution handles search and export?

Take the time to determine if your current setup is ready to handle SOX and outline everything that is missing. If not, having the questions ready will help you find the new solution.

Choose an archiving solution

Once you understand that there’s a need for change, you can take a look at new options for SOX data archiving solutions.

There are now many technical solutions that can enhance security and help you ensure compliance with data retention laws.

The key lies in finding an email archiving solution that archives your information securely and allows data to be retrieved but not deleted, altered, or damaged.

Before choosing a data archiving solution for your organization, don’t forget to check its compatibility with your email provider and other channels.

Implement an archiving system

Choosing your archiver isn’t the end of your SOX compliance strategy. Take your time and work together with the solution provider to implement the system properly.

During the implementation stage, you need to watch for any risks of data being lost or corrupted as it is migrated into the new system.

Many organizations are reluctant to change their existing archiving system because they worry about the risks associated with migration, which is why you should always look for archiving companies that assist with data ingestion or provide a white glove service.

Manage your compliance toolkit

Remember that compliance is an ongoing process for your entire organization.

Continuously assessing security risks and managing your information is the best way to ensure you’re fully compliant.

Regularly update your retention policies, manage retained and deleted data, and manage your primary inboxes.

Remember that every organization is different. This means compliance strategies can vary, but the steps you take from understanding the legislation to monitoring the archiving process will remain the same.

How Data Archiving Keeps You SOX-Compliant

The implementation of secure data archiving systems has proven to be the most straightforward way to ensure compliance with SOX.

SOX-compliant archiving software are solutions that comply with all SOX regulations and retention requirements by automatically capturing all of your communications data.

This data comes in the form of email, social media, text messages, and other types of unstructured data, which all needs to be archived for you to achieve SOX compliance.

Data archiving software complies with SOX with their robust feature set which allows you to:

• Automatically capture data — Every piece of communication data is stored in one central repository the moment it’s sent or received. This includes all of its crucial metadata, attachments, and message threads.
• Indexing and integrity — Captured data is indexed and stored in a write-once-read-many (WORM) format, preventing any edits or deletion with an ability to perform message integrity check to prove the data wasn’t tampered with.
• Encryption — Industry-standard encryption protocols allow you to keep it protected and combat potential theft and breaches.
• Custom retention policies — Create your own data retention policies depending on the data type, retention requirements, and many other parameters custom to your organization.

• Automated data retention — SOX-compliant software applies your custom policies automatically whenever new data is archived, without human intervention. This data is also automatically deleted when the defined retention window expires.
• Advanced search — Locate any electronic records (email, PDF, attachment, social media posts, text messages) in seconds with search features like Boolean, fuzzy, proximity operators and filtered searches.

• Archive roles — Segregate your team into different roles and prevent unauthorized actions inside your archive. Allow only the necessary level of access.

These are only a few ways a SOX-compliant archiving software can help you maintain compliance.

A central repository that an archiving solution offers prevents your ESI from being scattered across servers, devices, and bulky PST files and removes the risk of relying on external servers.

Archiving data with solutions like Jatheon entails many benefits besides full SOX compliance.

It also allows your business to:

• Simplify the ediscovery process — Respond to record requests and financial reports by directors and auditors in a timely manner.
• Centralize data storage — Remove the need for multiple archiving software and retain every communication channel in one place.
• Communicate transparently — Utilize easy data tracking, indexing, and keyword alerts to ensure transparency with all external parties.
• Optimize data storage — Automate the data retention and deduplication process to utilize your limited storage optimally without additional storage costs.

Conclusion

What SOX was aiming to bring to companies is greater market stability and higher security levels.

However, in a practical sense, the Act forced companies to revise the way they handle their internal communication, guarantee sensitive data handling, and provide transparent business operations.

This forced companies to shift their compliance strategy towards complying with SOX retention requirements to stay compliant.

The solution came in the form of SOX-compliant archiving software, allowing for greater control and safety of data for all publicly held companies.

FAQ

What are the 4 controls of SOX?

The 4 SOX controls are access control (physical prevention of unauthorized access), IT security (ensuring controls to prevent data breaches), data backups (backup systems to protect data), and change management (ability to add new users and computers and make changes to the data infrastructure).

Who regulates SOX?

Sarbanes-Oxley Act (SOX) is regulated by the US Securities and Exchange Commission (SEC) and the Public Company Accounting Oversight Board (PCAOB). SEC governs financial reporting and corporate governance for publicly traded companies while the PCAOB regulates audit firms.

Is SOX compliance mandatory?

SOX compliance is mandatory for every publicly traded US company and some private companies. Not complying with SOX regulations can have serious legal and financial consequences for the company.

What happens if you are not SOX compliant?

SOX non-compliance can result in organization penalties in fines, unlisting from public stock exchanges, or imprisonment. The severity depends on whether you knowingly and purposely didn’t meet SOX requirements, willfully submitted non-compliant reports, or your organization failed an audit.

Is SOX only for public companies?

SOX isn’t exclusive to public firms. It applies to private companies too, covering compliance with federal/state laws, preventing document manipulation in federal investigations, and prohibiting retaliation against those informing law enforcement about federal offenses.

About the Author

Marko Dinic

As Jatheon’s CEO, Marko Dinic oversees new business development and has a leadership role in shaping the company’s vision, strategy, and product development. Outside work, he loves visiting places off the beaten path, investing, and space travel.