Sarbanes-Oxley internal controls now demand always-on monitoring

At a glance

What this is: This is a control-governance analysis of how Sarbanes-Oxley programmes move from periodic testing to continuous monitoring across entity-level controls, process controls, and ITGCs.

Why it matters: For IAM, IGA, PAM, and compliance teams, the article reinforces that access governance, SoD enforcement, and monitoring must be operationalised continuously to support financial reporting integrity.

Context

Sarbanes-Oxley internal controls only work when organisations can see, enforce, and evidence control performance across finance processes and the systems that support them. The problem is not a lack of controls on paper, but the gap between periodic testing and the daily control failures that can affect financial reporting integrity.

That gap matters to identity and access programmes because segregation of duties, access approvals, and privileged activity monitoring are now part of the control plane for SOX readiness. When those controls are still managed as annual audit tasks, the organisation is reacting to evidence gaps rather than operating a governed control environment.

Key questions

Q: How should teams operationalise Sarbanes-Oxley controls beyond annual testing?

A: They should turn preventive, detective, and corrective controls into a continuous control cycle tied to real business workflows and system activity. That means SoD rules, privileged access monitoring, change approvals, and remediation tracking are always active, not reserved for audit season. The goal is to produce evidence from live operations, not reconstruct it after the fact.

Q: Why do ITGC weaknesses undermine financial reporting controls?

A: Because application controls depend on the trustworthiness of the systems they run on. If access management, change management, or configuration controls are weak, the resulting transaction data and approvals may be unreliable even when the application itself appears compliant. Strong ITGCs make the rest of the control stack auditable and defensible.

Q: What breaks when segregation of duties is not continuously monitored?

A: Toxic combinations can persist unnoticed in privileged, financial, and regulated-data workflows. Without continuous monitoring, organisations often detect violations only after a transaction, audit finding, or incident. The result is delayed remediation, weaker accountability, and a higher chance that one identity can control both sides of a sensitive process.

Q: What role does accountability play in SOX control ownership?

A: SOX works best when finance, IAM, and IT operations share explicit responsibility for different parts of the control chain. Finance owns the business risk, IAM governs access and role design, and IT validates the system controls that support evidence. Without that split ownership, monitoring may exist but no one is clearly accountable for fixing what it reveals.

Technical breakdown

How preventive, detective, and corrective controls fit together

Sarbanes-Oxley control design is layered. Preventive controls block risky activity before it happens, detective controls surface exceptions after execution, and corrective controls close the loop by remediating the issue and adjusting the control design. In practice, those controls must align across people, process, and technology or they become isolated checkpoints that are difficult to prove and harder to sustain. For SOX, that means access governance, transaction approvals, logging, reconciliation, and remediation cannot be treated as separate disciplines. Practical implication: map each critical financial process to a control chain that includes prevention, detection, and correction, not just one control type.

Practical implication: map each critical financial process to a control chain that includes prevention, detection, and correction, not just one control type.

Why ITGCs carry the weight of SOX evidence

IT general controls are the foundation beneath application controls because they govern who can access systems, how changes are introduced, how operations are performed, and whether backups and recovery are trustworthy. If ITGCs are weak, application-level controls may still exist but their outputs are less reliable because the underlying system state cannot be trusted. Access management, change management, and configuration standards therefore become evidence sources for the audit, not just security hygiene. Practical implication: treat ITGC monitoring as a continuous evidence pipeline for financial reporting systems, especially ERP platforms and databases.

Practical implication: treat ITGC monitoring as a continuous evidence pipeline for financial reporting systems, especially ERP platforms and databases.

How SoD and access reviews become operational controls

Segregation of duties reduces the chance that one person can create and approve the same high-risk transaction, while access reviews confirm those boundaries still hold after role changes and exceptions. The article’s core message is that these are not static policy statements. They need ongoing correlation between identity data, application entitlements, and transaction activity to catch privilege combinations that create fraud or error risk. In a SOX environment, that makes access governance an active control function rather than a periodic certification exercise. Practical implication: continuously test for SoD conflicts and review access in the same cadence as the business risk changes.

Practical implication: continuously test for SoD conflicts and review access in the same cadence as the business risk changes.

Breaches seen in the wild

• Zacks breach claim 2025: A hacker leaked 12 million Zacks accounts in 2025, claiming domain admin access in 2024; HIBP verified the data, Zacks has not confirmed.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Always-on control monitoring is now the baseline expectation for SOX programmes. Annual point-in-time testing leaves too much time between the control failure and the evidence that proves it happened. The article reflects a broader shift: continuous visibility is becoming the only credible way to manage financial reporting control integrity across modern ERP and identity estates. Practitioners should assume periodic review alone no longer carries enough assurance weight.

Segregation of duties has become an identity governance problem, not just a finance rule. The control is enforced through entitlements, workflow paths, and privileged combinations across systems, which means IAM and IGA teams now sit inside the SOX control surface. That makes access provisioning, role design, and exception handling part of audit readiness. Practitioners should treat SoD conflict management as a governed identity process, not an annual spreadsheet exercise.

ITGC evidence is only as strong as the monitoring around privileged activity and change. If privileged access, configuration drift, and change approvals are observed too late, the organisation can still pass individual reviews while missing the pattern that undermines control reliability. Continuous control monitoring makes the control environment more inspectable, but it also raises the bar for disciplined remediation. Practitioners should expect stronger expectations for real-time control evidence, not just retrospective attestations.

Entity-level oversight and process-level control execution now need tighter linkage. Tone at the top, audit committee oversight, and risk management only matter operationally when they are reflected in the workflows that close, approve, and post financial activity. The practical consequence is that SOX programmes cannot be split between governance theatre and technical enforcement. Practitioners should align control ownership across finance, IAM, and IT operations.

What this signals

Continuous control visibility is becoming the operating model for SOX readiness. Organisations that still depend on annual certification cycles are carrying avoidable evidence risk because control exceptions are discovered after the fact, not during normal operations. The governance shift is toward live monitoring of privileged access, approvals, and changes so control failures are visible while they can still be contained.

SoD is increasingly an identity and workflow design problem. The practical challenge is no longer whether a policy exists, but whether entitlements and transaction paths make incompatible actions impossible or at least detectable. Programmes that join IGA, PAM, and finance workflow controls will have a clearer path to defensible audit evidence.

For practitioners

• Codify SoD rules across financial workflows Map incompatible duties in vendor setup, journal entry, invoice payment, and purchase order approval to enforceable access rules across ERP and adjacent systems.
• Run continuous access reviews for high-risk entitlements Focus reviews on privileged and finance-impacting roles, then correlate exceptions to actual transaction activity so stale access does not survive until the annual audit.
• Instrument ITGC monitoring as an evidence stream Collect change, access, and configuration signals from the systems that support financial reporting so control owners can see failures before audit season.
• Tie remediation to control re-test cycles When a control weakness is found, update the process or configuration and re-test the affected control until the evidence shows the deficiency has been closed.

Key takeaways

• Sarbanes-Oxley control strength now depends on whether organisations can monitor access, approvals, and changes continuously rather than only during audit preparation.
• ITGCs remain the backbone of reliable financial reporting because weak system controls make downstream application controls harder to trust and prove.
• Teams should align finance, IAM, and IT operations around enforced SoD, live monitoring, and documented remediation so deficiencies do not linger until the next audit cycle.

Key terms

• Internal Controls Over Financial Reporting: A control system that helps ensure financial information is accurate, complete, and timely enough for external reporting. In practice, it ties process design, approvals, evidence, and oversight together so auditors can test whether financial statements are trustworthy.
• IT general controls: The foundational controls that support reliable systems, access, and change management across an enterprise application stack. In practice, ITGC determines whether auditors trust the environment enough to rely on higher-level business controls and transaction evidence.
• Segregation of Duties: Segregation of Duties is a control principle that prevents one person or role from combining incompatible permissions that could create fraud, error, or undetected change. In ERP environments, it must account for roles, transactions, approvals, and compensating controls across business processes.
• Continuous Controls Monitoring: Continuous controls monitoring is the ongoing evaluation of transactions, access, and configuration changes against policy rules. It replaces occasional sample testing with near-real-time detection, which gives security, audit, and finance teams faster evidence and a better chance to correct drift before it becomes a finding.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.