SOX access controls expose the real identity governance gap

At a glance

What this is: This analysis argues that SOX failures usually emerge from identity and access control weaknesses, especially around certification, segregation of duties, and audit evidence.

Why it matters: It matters because IAM, IGA, PAM, and governance teams must be able to prove access decisions, not just describe them, when financially material systems are in scope.

By the numbers:

• 44% identify IT access controls as the area with the most audit challenges and deficiencies.
• 24% report a significant expansion in SOX scope over the past year.
• 39% report moderate increases in SOX scope.

Context

SOX compliance is really a question of whether identity and access controls can stand up to audit scrutiny. The article frames the problem plainly: if the wrong person can reach a financial system, that access is never reviewed, and no one can prove what happened, then the control environment is already failing.

For security and identity teams, the hard part is not the policy statement but the evidence trail. Section 404 work lives in access certification, segregation of duties, provisioning, and audit documentation, where spreadsheet-driven processes often collapse under time pressure and incomplete context.

That makes SOX a governance problem as much as a compliance requirement. In practice, organisations need current access data, reviewer accountability, and revocation proof tied back to the source system, or the control may exist on paper while failing in the real environment.

Key questions

Q: Why do SOX access controls break down as environments get more complex?

A: They break down because governance often becomes inconsistent across platforms, owners, and account types. The control may still exist, but the evidence changes from system to system, which makes audits harder and increases the chance that privileged or non-human access is missed. Complexity exposes variance, not just scale.

Q: Why do weak access controls create SOX audit problems?

A: Weak access controls undermine SOX assurance because auditors rely on them to trust the systems producing financial data. If provisioning, reviews, or privileged access are inconsistent, segregation of duties can be bypassed and the evidence trail becomes unreliable. The result is more manual testing, more exceptions, and a higher risk that control deficiencies are escalated.

Q: What are the signs that SOX access reviews are not working?

A: Common signs include stale review data, rubber-stamped approvals, missing revocation evidence, and unresolved SoD conflicts across financial systems. If the certification process produces a report but not a trustworthy change record, the control is likely procedural rather than effective.

Q: Who should own identity governance decisions for SOX compliance?

A: Ownership should be shared across IAM, SOX Program Leads, Internal Audit, and the relevant control owners for financial systems. IAM can operate the platform, but audit defines the evidence standard and SOX defines the risk boundary. If those functions are separated, coverage decisions will favour operational efficiency over control effectiveness.

Technical breakdown

Why access certification fails when reviewers lack context

Access certification is meant to confirm that each entitlement still matches business need, but the control degrades quickly when reviewers only see static spreadsheets. Without current usage, role context, and ownership data, reviewers rubber-stamp entries they cannot confidently evaluate. In SOX terms, the issue is not just missed revocations. It is a control that produces a completed checklist without producing reliable assurance. The article also shows why annual-only review is weak for high-risk systems: access changes faster than the certification cycle, so the review becomes stale before auditors inspect it.

Practical implication: feed reviewers live access data and decision context, or their approvals will not be defensible under Section 404.

How segregation of duties becomes an identity problem

Segregation of duties is a financial control principle, but in modern systems it is enforced through identity entitlements. The same user can accumulate rights across ERP, finance, and cloud applications until they can both initiate and approve a transaction. That is why SoD is rarely a one-time design exercise. It requires continuous detection of conflicting access, not just periodic policy review. The article makes clear that auditors expect documented rules, conflict lists, and remediation rationale, because SoD failures are often the result of access growth over time rather than a single bad grant.

Practical implication: map SoD rules to actual entitlement combinations and monitor conflict drift continuously, especially after role changes.

Why audit evidence is stronger when it is queryable rather than assembled

SOX requires evidence that controls worked, not just evidence that teams intended to make them work. That means access logs, provisioning records, certification outcomes, and exception handling must be retrievable by user, system, and date. Manual evidence collection creates gaps because teams have to reconcile inconsistent formats, timestamps, and retention practices across systems. The article's core message is that centralised identity data reduces the burden of proving control effectiveness, especially when auditors ask targeted questions about one access decision at a specific point in time.

Practical implication: centralise identity and access evidence so audit requests can be answered from operational records instead of reconstruction.

Threat narrative

Attacker objective: The end state is unauthorised or unproven access to financially material systems that weakens control assurance and can trigger audit disclosure.

1. Entry occurs when a user is granted access to a financial system without adequate role validation or timely review.
2. Escalation follows when entitlements accumulate across systems and create segregation-of-duties conflicts that were not detected before use.
3. Impact appears when revoked or inappropriate access cannot be proven, leaving the organisation exposed to audit findings, material weaknesses, and delayed remediation.

Breaches seen in the wild

• McKinsey AI platform breach: McKinsey AI platform hack exposed 46M chats and sensitive data.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

SOX access control is an identity governance test, not an accounting test. The article shows that the control failures auditors care about live in access certification, entitlement scope, and proof of revocation. When those controls are weak, financial reporting risk is really identity risk in disguise. The implication is that SOX readiness depends on governance over who can do what in financially material systems, not on spreadsheet completion.

Spreadsheet-based access review creates a false sense of compliance. A completed certification cycle does not equal a working control if reviewers lacked current context and revocations were not executed. That is the gap auditors detect most quickly: process activity without operational follow-through. The practitioner conclusion is simple: evidence quality matters as much as the review itself.

Segregation of duties becomes fragile once identity sprawl crosses systems. The article makes clear that conflicts are not usually created in one place, they accumulate across ERP, cloud, and finance tooling as roles shift. That means SoD is a lifecycle issue, not a pre-audit checklist item. Teams that treat it as static will keep discovering conflicts after the fact.

Identity evidence is now part of the control environment. If access decisions cannot be traced, timestamped, and exported on demand, then the organisation cannot reliably demonstrate control effectiveness. That shifts the burden from documentation to operational proof. For practitioners, the real benchmark is whether an auditor can ask about one user on one date and get a complete answer quickly.

Access certification, SoD, and lifecycle governance belong in one operating model. The article ties together provisioning, review, revocation, and evidence collection because SOX failures rarely respect organisational silos. A disconnected model leaves each control weaker than the sum of its parts. The conclusion is that identity governance for financial systems must be run as a continuous control system, not an annual audit project.

What this signals

Identity evidence is becoming the audit boundary. When access decisions are made, reviewed, and revoked across multiple systems, the real control is the ability to prove each step after the fact. Teams that cannot query their evidence quickly will keep treating audit readiness as a one-off project instead of an operating state.

Continuous controls matter more than annual review cycles. SOX access governance breaks down when entitlement drift is allowed to accumulate between audit windows. The stronger model is continuous certification and SoD monitoring, because that is what keeps the control aligned with how fast access actually changes.

For practitioners

• Automate access certification for in-scope financial systems Move reviewers off static spreadsheets and into workflows that show live entitlements, ownership, usage context, and prior review outcomes for each user.
• Continuously detect segregation-of-duties conflicts Check conflicting entitlements at provisioning, role change, and request time so SoD exceptions are flagged before they reach financial systems.
• Capture revocation proof in the source system Record reviewer identity, decision timestamp, and execution status so certification outcomes can be tied back to the actual access change.
• Centralise audit evidence across applications Store certification records, provisioning history, exception approvals, and change logs in one queryable control record for auditor retrieval.
• Prioritise Tier 1 financial systems first Start with ERP, consolidation platforms, and data stores that hold financial data because these environments create the highest audit exposure and the most manual work.

Key takeaways

• SOX access failures are usually identity governance failures, because the control problem sits in who has access, who reviewed it, and whether the result was actually enforced.
• The article points to a familiar operational weakness: spreadsheet-based certifications and manual evidence collection cannot reliably support auditor scrutiny at scale.
• Teams reduce exposure when they treat access review, SoD monitoring, and evidence retention as one continuous control system rather than separate audit tasks.

Key terms

• Access Certification: Access certification is the periodic review of whether an identity still needs its current entitlements. For NHIs, certification is only reliable when reviewers know the identity's owner, purpose, and expiry, otherwise stale machine access can persist long after the original use case has ended.
• Segregation of Duties: Segregation of Duties is a control principle that prevents one person or role from combining incompatible permissions that could create fraud, error, or undetected change. In ERP environments, it must account for roles, transactions, approvals, and compensating controls across business processes.
• Internal Controls Over Financial Reporting: A control system that helps ensure financial information is accurate, complete, and timely enough for external reporting. In practice, it ties process design, approvals, evidence, and oversight together so auditors can test whether financial statements are trustworthy.
• Material weakness: A material weakness is the most severe category of internal control failure, indicating a reasonable possibility of a material misstatement or a serious breakdown in trust. For identity teams, the parallel is a control environment so weak that access evidence, approvals, or lifecycle operations can no longer be relied upon.

Deepen your knowledge

NHI governance, identity lifecycle management, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or governance in your organisation, it is worth exploring.