SOX Compliance and Data Governance for Financial Reporting

SOX compliance is how US public companies meet the Sarbanes-Oxley Act of 2002, the law passed after major accounting scandals to make financial reporting more reliable. At its center is internal control over financial reporting: the processes and controls that give reasonable assurance that the financial statements are accurate. Today, most of those statements are produced from data that moves through many systems before it reaches a report.

That is why SOX has become a data governance topic. When an auditor asks how a number in the 10-K was produced, the answer runs through source systems, data pipelines, the general ledger, and reporting tools, and the company has to show that the data was complete, accurate, and protected from unauthorized change along the way.

What Is SOX Compliance?

SOX compliance means meeting the Sarbanes-Oxley Act's requirements for financial reporting, disclosure, and internal control. It applies to companies with securities registered with the US Securities and Exchange Commission, including publicly listed banks and bank holding companies. Insured banks that are not listed can face similar requirements: FDICIA and the FDIC's Part 363 rules require annual audits and internal control reporting from institutions above set asset thresholds.

In practice, a SOX program has four parts:

• Scoping. Identify the significant accounts and disclosures, the processes behind them, and the systems that support those processes.
• Control design. Document the controls that address the risk of material misstatement, both manual controls and automated controls in applications.
• Testing. Test whether controls are designed and operating effectively, first by management and, where required, by the external auditor.
• Remediation and reporting. Fix deficiencies, assess whether any is a material weakness, and report the conclusion in the annual report.

Key SOX Sections

In 2020, the SEC amended the accelerated filer definitions so that smaller reporting companies with annual revenues below $100 million are not accelerated filers, and therefore do not need the Section 404(b) auditor attestation. They still have to comply with Section 404(a).

Internal Control over Financial Reporting and COSO

Internal control over financial reporting is the set of processes designed to provide reasonable assurance that financial statements are reliable and prepared in accordance with generally accepted accounting principles. Management needs a recognized framework to assess it, and most US companies use the COSO Internal Control - Integrated Framework, updated in 2013, with its five components: control environment, risk assessment, control activities, information and communication, and monitoring activities.

For the audit, the Public Company Accounting Oversight Board's AS 2201, An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements, sets the standard. It takes a top-down, risk-based approach that starts with the financial statements and works down to the accounts, processes, and controls that matter most. AS 2201 explicitly addresses information technology general controls and the application controls that depend on them.

IT General Controls (ITGCs)

IT general controls are the controls over systems that make automated controls and system-generated reports reliable. If ITGCs fail, an auditor cannot rely on what the system produces. They are commonly grouped into four areas:

• Access to programs and data. Only authorized people can change financial data, configurations, or code, and access is reviewed regularly.
• Program change management. Changes to applications, interfaces, and data transformations are requested, tested, approved, and documented before they reach production.
• Program development. New systems and major changes are built and implemented under controlled processes, including data migration.
• Computer operations. Batch jobs, interfaces, and backups run as intended, and failures are detected and resolved.

Data pipelines that feed the general ledger and financial reports are in scope when they affect significant accounts. A change to an ETL job that maps accounts, for example, is a program change that can affect the financial statements.

Where Data Governance Fits in SOX

SOX does not mention data catalogs or data lineage, and no rule requires them. But the questions auditors ask about data, and the evidence they expect, map closely onto data governance practices.

• "Where does this number come from?" Auditors walk through how significant amounts are produced. Documented data lineage, at column level for the fields that matter, shortens walkthroughs and shows which systems and transformations are in scope.
• "What does this field mean?" Inconsistent definitions of revenue, segments, or loan status between systems create reconciliation breaks. A shared business glossary fixes the meaning once.
• "Who is responsible?" Controls need owners. Naming a business owner for each critical account and data element, as in a critical data element program, makes accountability explicit.
• "What changed, and was it approved?" Change management is an ITGC. Knowing which reports and accounts depend on a table or pipeline tells reviewers what a change could affect before it is approved.
• "Is the data complete and accurate?" Data quality checks and reconciliations at key points provide evidence that data was not lost or altered on the way.

For banks, the same governance also serves other demands on the same data: the allowance for credit losses under CECL, regulatory reports such as the Call Report, and stress testing. One set of definitions, owners, and lineage supports all of them.

How Dawiso Supports It

Dawiso is not a SOX compliance or controls testing tool, and it does not replace the controls in your financial systems. It provides the governance layer that helps finance, data, and audit teams answer questions about reported data.

• Definitions for financial terms and metrics. The business glossary records business terms and business indicators with definitions, calculations, and named Owners and Stewards.
• Lineage from source to report. Data lineage shows how data flows between systems, tables, columns, and reports, which supports walkthroughs and impact analysis before a change.
• A catalog of reporting assets. The data catalog documents the tables, reports, and other assets in scope so they can be found and understood.
• Approval workflows. Configurable workflows route changes to definitions through states such as draft, review, and approved.

See how this applies to finance teams in consistent financial reporting.

Conclusion

SOX compliance asks a simple question with a complicated answer: can the company show that its financial statements are reliable? Sections 302 and 404 put that responsibility on management and, for larger filers, on the external auditor. Because financial statements are now built from data that passes through many systems, much of the evidence is about data: where it came from, what it means, who owns it, and how changes are controlled. No regulation requires a catalog or lineage tool, but shared definitions, clear ownership, and documented lineage make that evidence easier to produce and harder to dispute.

Sources

• US Congress - Sarbanes-Oxley Act of 2002, Public Law 107-204
• PCAOB - AS 2201: An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements
• US Securities and Exchange Commission - SEC amends accelerated filer definitions (press release 2020-58)
• COSO - Guidance on Internal Control (Internal Control - Integrated Framework)