Topic starter
16/01/2026 5:04 pm
TL;DR: SOX compliance still depends on identity controls, according to Pathlock, because financial reporting controls only hold when access reviews, segregation of duties, audit trails, and executive accountability are reliable enough to withstand scrutiny. The deeper lesson is that financial control failures often begin as identity governance failures, so IAM and PAM remain core SOX controls rather than adjacent support functions.
Editorial analysis by NHI Mgmt Group, based on content published by Pathlock: “A Comprehensive Guide to SOX Compliance in 2025”.
Key questions
Q: What breaks when separation of duties is not in place for access management and financial controls?
A: Without separation of duties, one person can grant access, approve transactions, and potentially conceal mistakes or abuse.
Q: Why do access reviews matter so much in SOX programmes?
A: Because they prove that access to financial systems is appropriate, approved, and periodically revalidated.
Q: What are the warning signs that identity controls are undermining SOX?
A: Warning signs include unresolved SoD conflicts, broad shared roles, privileged accounts that are not separately reviewed, and audit trails that cannot link actions to named identities.
Practitioner guidance
- Strengthen access certification for finance systems Base recertification on current entitlements, real usage, and system ownership so that dormant or inherited access is removed before audit testing begins.
- Enforce segregation of duties in workflow design Block conflicting create, approve, and record combinations inside ERP and reporting workflows so the control exists before a transaction is executed.
- Link audit logs to named identities and approvals Make sure finance-system logging preserves unique user identity, approval sequence, and timestamps so auditors can reconstruct control operation without manual guesswork.
Bottom line: SOX control failures often begin as identity control failures, especially when access, approvals, and certification are not enforced in the same workflow.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/10/2026 3:55 am
SOX is an identity governance problem first and a finance rule set second. Financial reporting becomes reliable only when access, approvals, and attestations are controlled end to end. That means IAM, PAM, access review, and SoD enforcement are not support functions around SOX, they are the operational core of SOX readiness.
A question worth separating out:
Q: How should finance and security teams respond when SOX findings point to access control gaps?
A: They should treat the finding as a control-design issue, not just an audit remediation item. The right response is to map the affected finance process, identify who can initiate, approve, and certify it, and remove any access path that collapses those responsibilities into one identity.
👉 Read our full editorial: SOX compliance shows why identity controls still matter in finance