Topic starter
28/04/2026 4:50 pm
TL;DR: SOX audit failures often stem from access control gaps rather than accounting errors: Protiviti's 2024 report says 44% of organisations face the most audit challenges in IT access controls, while 24% report a significant expansion in SOX scope, according to Oleria Security. Manual reviews and spreadsheet evidence leave auditors with weak proof and delayed revocations.
Editorial analysis by NHI Mgmt Group, based on content published by Oleria Security: “SOX Compliance Checklist: How identity automation helps pass audits”.
By the numbers:
- 44% identify IT access controls as the area with the most audit challenges and deficiencies.
- 24% report a significant expansion in SOX scope over the past year.
- 39% report moderate increases in SOX scope.
Key questions
Q: Why do SOX access controls break down as environments get more complex?
A: They break down because governance often becomes inconsistent across platforms, owners, and account types.
Q: Why do weak access controls create SOX audit problems?
A: Weak access controls undermine SOX assurance because auditors rely on them to trust the systems producing financial data.
Q: What are the signs that SOX access reviews are not working?
A: Common signs include stale review data, rubber-stamped approvals, missing revocation evidence, and unresolved SoD conflicts across financial systems.
Practitioner guidance
- Automate access certification for in-scope financial systems Move reviewers off static spreadsheets and into workflows that show live entitlements, ownership, usage context, and prior review outcomes for each user.
- Continuously detect segregation-of-duties conflicts Check conflicting entitlements at provisioning, role change, and request time so SoD exceptions are flagged before they reach financial systems.
- Capture revocation proof in the source system Record reviewer identity, decision timestamp, and execution status so certification outcomes can be tied back to the actual access change.
Bottom line: SOX access failures are usually identity governance failures, because the control problem sits in who has access, who reviewed it, and whether the result was actually enforced.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 7:17 pm
SOX access control is an identity governance test, not an accounting test. The article shows that the control failures auditors care about live in access certification, entitlement scope, and proof of revocation. When those controls are weak, financial reporting risk is really identity risk in disguise. The implication is that SOX readiness depends on governance over who can do what in financially material systems, not on spreadsheet completion.
A question worth separating out:
Q: Who should own identity governance decisions for SOX compliance?
A: Ownership should be shared across IAM, SOX Program Leads, Internal Audit, and the relevant control owners for financial systems. IAM can operate the platform, but audit defines the evidence standard and SOX defines the risk boundary. If those functions are separated, coverage decisions will favour operational efficiency over control effectiveness.
👉 Read our full editorial: SOX access controls expose the real identity governance gap