# Identity security in the era of SOX
Author:  Pal Sinha, Barnali 
Author URL: https://financedigest.com/author/pal-sinha-barnali
Published: 2021-11-30
Category: FINANCE
Category URL: https://financedigest.com/category/finance
Meta Title: Navigating UK SOX Compliance: Protecting Financial Integrity
Meta Description: Discover how the UK is preparing for its own version of the Sarbanes-Oxley Act, aiming to restore trust in audit and corporate governance for public interest
URL: https://financedigest.com/identity-security-in-the-era-of-soxhtml

![undefined](https://prod.superblogcdn.com/site_cuid_cm5qst7v3003gwirgwqtxn8i8/images/identity-sbi-300199800-1736836785767-compressed.jpg)

_By_ **_Steve Bradford,_** _Senior Vice President, EMEA, SailPoint_

The Sarbanes-Oxley Act (SOX) is a federal law that mandates practices in auditing and financial regulations for public companies. Its original intent being to restore trust in a corporate and financial system that had been rocked by major accounting scandals such as Enron, WorldCon and Tyco. Legislators believed if there was no trust in the [major corporate](https://www.financedigest.com/mcdermotts-milan-office-sees-major-boost-with-arrival-of-new-corporate-transactional-team.html "McDermott’s Milan Office Sees Major Boost with Arrival of New Corporate & Transactional Team") institutions of America, then the whole fabric of capitalism could be brought into question.

Initially only applying to American companies, every major institution that dealt with America had to comply with SOX. It was a huge a [success with the number of financial](https://www.financedigest.com/why-teaching-your-children-financial-literacy-from-a-young-age-will-set-them-up-for-success.html "Why teaching your children financial literacy from a young age will set them up for success") scandals emanating from the US dropping dramatically since compliance. But can The UK follow suit?

**Preparing for “SOX UK”**

The UK has had its own high profile business collapses – notably [BHS and Carillion](https://www.bbc.co.uk/news/business-54056046). So, the government has [launched a consultation programme](https://www.financedigest.com/uk-to-launch-new-billion-pound-home-insulation-programme.html "UK to launch new billion-pound home insulation programme") that mimics the US SOX rules. The consultation on [reforms aims to ‘restore trust in audit and corporate governance’ and applies to auditors](https://www.financedigest.com/how-auditors-can-prepare-for-reform-now.html "How auditors can prepare for reform now"), companies, directors, audit committees, investors, other stakeholders, and the regulator.

A focus is on companies with a significant public interest, otherwise known as Public Interest Entities (PIEs). These include [financial institutions](https://www.financedigest.com/a-cloud-migration-guide-for-financial-institutions.html "A Cloud Migration Guide for Financial Institutions"), banks, insurance companies, underwriters, and alike – many of which are already familiar with a high degree of financial scrutiny. A noteworthy difference is the stated preference to expand the UK SOX controls beyond public interest companies, which could include large [companies in retail](https://www.financedigest.com/retail-pricing-software-company-bolsters-leadership-team.html "Retail pricing software company bolsters leadership team"), manufacturing, logistics and automotive.

UK SOX may seem like a massive undertaking if unfamiliar, but with the right technologies in place manual tasks can become automated, [reducing time which can be then redirected to greater priorities or risks](https://www.financedigest.com/uk-businesses-need-to-embrace-payment-technologies-to-reduce-financial-damage-risk.html "UK businesses need to embrace payment technologies to reduce financial damage risk"), and everyday operations will be guided by a strong set of well-defined controls.

**A** [growing threat](https://www.financedigest.com/cyber-threats-a-growing-concern-among-citizens-more-than-one-out-of-ten-subject-to-data-breaches.html "Cyber threats a growing concern among citizens – more than one out of ten subject to data breaches")

The [Sarbanes-Oxley Compliance 9-Step checklist](https://www.sarbanes-oxley-101.com/sarbanes-oxley-checklist.htm) provides a series of recommendations to protect the validity of all reported information and help businesses to ensure they are following the rules. This includes the [need to establish](https://www.financedigest.com/insurtech-why-established-players-need-to-act-fast.html "Insurtech: Why Established Players Need to Act Fast") controls to prevent data tampering, track data access, test the effectiveness of safeguards and detect security breaches – any of which need to be reported to SOX auditors on time.

As both physical and digital information are affected, accurate [management is an integral part of compliance](https://www.financedigest.com/fintech-and-compliance-managing-the-eternal-balancing-act.html "Fintech and compliance: Managing the eternal balancing act"). Remote working, blockchain integration, and the emergence of cloud-based banking (Banking as a Service) have led to growing [cyber threats](https://www.financedigest.com/5-ways-to-protect-your-company-from-cyber-security-threats.html "5 Ways to Protect Your Company From Cyber Security Threats"), privacy concerns and compliance requirements through the complexities of connectivity.  For example,  multiple devices now connect to [networks from different locations](https://www.financedigest.com/hermes-extends-parcelshop-network-with-doddle-locations.html "HERMES EXTENDS PARCELSHOP NETWORK WITH DODDLE LOCATIONS"), accessing the vast amount of information in the cloud. There is now critical [need to close security](https://www.financedigest.com/why-preparation-for-new-swift-cyber-security-standards-needs-to-start-now.html "‘Why preparation for new SWIFT cyber security standards needs to start now’") gaps outside the perimeter.

Some of the greatest [threats lie within an organisation](https://www.financedigest.com/cyber-threats-for-finance-organisations-to-watch-in-2023.html "Cyber threats for finance organisations to watch in 2023") – either human error or more likely, the rise in risk facing the access today’s workforce has to technology. Complex corporate structures and departmental silos hinder [management’s visibility into workforce](https://www.financedigest.com/6-keys-to-managing-a-remote-first-workforce.html "6 Keys to Managing a Remote-First Workforce") roles, responsibilities, and data access. Traditional reliance on spreadsheets and [manual processes for tracking data](https://www.financedigest.com/from-sec-edgar-to-business-applications-exploring-an-alternative-to-manual-data-extraction.html "From SEC EDGAR to Business Applications: Exploring an Alternative to Manual Data Extraction") access and user identities leads to inaccuracies and inconsistencies.

Apart from being an auditing and reporting nightmare, the situation creates system gaps that are ripe for exploitation by threat actors.

**Maintaining** [security through identity](https://www.financedigest.com/the-push-and-pull-of-identity-security-adoption-in-the-financial-services-industry.html "The push and pull of identity security adoption in the financial services industry")

To meet security and compliance regulations, companies and [organisations must act smarter in how they protect](https://www.financedigest.com/protect-your-organisation-from-fraud.html "Protect your organisation from fraud") their “perimeter”, which is centred on its people – the new threat vector of choice. Companies [must prepare to automate business processes and embrace new security practices that fully protect](https://www.financedigest.com/brexit-why-investors-must-now-think-global-to-maximise-and-protect-wealth.html "BREXIT: WHY INVESTORS MUST NOW ‘THINK GLOBAL’ TO MAXIMISE AND PROTECT WEALTH") the workforce and the tools they need to  do their job.

Staying in [compliance with regulation](https://www.financedigest.com/the-lego-blocks-of-saas-how-microservices-can-help-ensure-compliance-with-changing-financial-regulations.html "The Lego blocks of SaaS: how microservices can help ensure compliance with changing financial regulations") is important for the safety of the company, but it is crucial that the right safety measures are in place. Identity access management can reduce the risk of insider threat, [data breaches and human error for financial](https://www.financedigest.com/how-data-governance-as-a-service-can-transform-the-financial-sector.html "How Data Governance-as-a-Service can transform the financial sector") reporting – enabling automated logging and report generation for companies to make smart decisions whilst uncovering and remediating hidden or unknown issues that pose inherent risk.

**The countdown to SOX**

One commodity [companies don’t have is an abundance of time](https://www.financedigest.com/oxford-bus-company-outsources-for-the-first-time.html "Oxford Bus Company Outsources for the First Time"). With less than 18 months to go until the SOX recommendations deadline, any form of automated access system is an essential first [step in ensuring companies are prepared](https://www.financedigest.com/exclusive-naftogaz-ceo-prepared-to-step-down-if-it-would-facilitate-debt-deal.html "Exclusive-Naftogaz CEO prepared to step down if it would facilitate debt deal"). Starting early is critical – given an implementation programme can take 18-24 months for a company that is used to stringent [financial regulations](https://www.financedigest.com/australia-financial-crimes-regulator-opens-investigation-into-britains-entain.html "Australia financial crimes regulator opens investigation into Britain’s Entain"). It’s time to get identity and access compliance right – automation can [save a significant amount of effort and money](https://www.financedigest.com/saving-money-hacks.html "Saving money hacks"), whilst improving the accuracy of identity management processes.

As seen in the US, UK companies not used to financial compliance procedures will have to catch up or ask for help – learning from the financial sector – and scale up their [auditing and control to comply with more stringent regulations](https://www.financedigest.com/german-regulator-hands-ey-2-year-audit-ban-over-wirecard-scandal-handelsblatt.html "German regulator hands EY 2-year audit ban over Wirecard scandal – Handelsblatt"). The rules are there to help provide the security that regulators [need](https://www.financedigest.com/the-financial-services-industry-needs-to-get-serious-about-cyber-security-in-the-covid-19-era.html "The financial services industry needs to get serious about cyber security in the Covid-19 era") for a secure commercial environment. Now is the [time to act](https://www.financedigest.com/it-is-time-insurers-act-smart-by-making-legacy-systems-a-thing-of-the-past.html "It is time insurers act smart, by making legacy systems a thing of the past") in order to reduce the risk.


---
This blog is powered by Superblog. Visit https://superblog.ai to know more.
---