The 3 Keys to SOX Compliance

Learn common challenges Compliance Officers face and the modern capabilities they must have to win.

Chances are, you’re not going to see Compliance Officer vs The Audit as a Marvel movie anytime soon, but these underdogs are a powerful line of defense against an incredibly complex opponent in a high-stakes arena.

Last year alone, financial institutions (FIs) experienced 690 incidents with confirmed data disclosure. Whether malicious or accidental, insider threats linked to Separation of Duties (SoD) violations comprised 27% of data breaches. As the driving force behind how an organization is managed, directed and governed, it’s up to Compliance Officers (CO) to decipher confusing or abstract laws, civil and criminal enforcement, raise risk awareness, and establish and integrate best practices.

But COs can’t keep their organization safe if they don’t have the right tools. Many companies with complex identity access requirements come to Saviynt after having audit findings around compliance violations. A modernized identity program is critical because it replaces outdated on-premise security tools that are too hard to manage, cost too much, and don’t deliver the value promised.

While it’s imperative to get compliance right up front — rather than dealing with the fallout after the fact — there are obstacles. Inadequate separation of duties, excessive access from a lack of least privilege security, and complex ERP/EHR access request processes are time-consuming and fraught with error.  In this series, we’ll dive into the top three common regulations that FI risk managers “do battle” with and how Saviynt can help you leap audits in a single bound.

What is the Sarbanes-Oxley Act?

The Sarbanes-Oxley Act of 2002 (SOX) was passed to address public outrage over high-profile corporate fraud cases — in particular, the Enron, WorldCom, and Tyco scandals — and significantly impacted the way FIs store and handle data. And while the details of SOX compliance are complex, the bottom line for COs is to ensure their audits show evidence of effective internal controls for both digital and physical assets.

SOX requires strict auditing, logging, and monitoring across all internal controls, network and database activity, login activity, account/user activity, and information access. Simply put, where is your sensitive data stored, who has access to it, why are they accessing it — and in the event of suspicious activities, can you stop or remediate access quickly? To be SOX-compliant, Compliance Officers need more than airtight procedures; they need auditing and monitoring tools that can provide three critical capabilities:

• Effective enforcement of Separation of Duties (SoD) policies
• Automatic logging and tracking tools that generate clear reports throughout the year
• Centralized administration of access management and identity governance

1. Lock Up Those SoD Violations

SoD violations occur when one person has permission to execute on both sides of a sensitive transaction. If you’re a small company and only have one person in accounts payable, for example, you need to make sure there are controls in place to ensure you don’t have the same person creating payables and cutting checks.

The Threat: Poor Cross-Application Visibility

Manually preparing an SoD internal audit can take hundreds of hours. And in today’s interconnected world, COs need a clear line of sight into how tasks interact across a wide range of cloud, on-prem, and hybrid applications to maintain compliance throughout the year.

With legacy Governance Risk Control (GRC) systems, you may only be able to look at one application at a time when preparing for an audit. Every system has its own security model and they’re all different. For instance, an SAP GRC module can look at SAP’s security model but doesn’t look for SoD violations outside of SAP. A sensitive transaction that moves across multiple applications would go undetected. Even GRC solutions that can look across applications are limited to a coarse-grained or high-level view. This becomes problematic since the action that would tip off a SoD violation may occur deep in the security model. To do their job, COs need deep visibility to fine-grained integrations within the applications.

The Solution: Unified SoD Management Controls

If you’re using multiple tools to detect insider threats — or if you’re manually removing access — you’re not riding into the sunset, you’re headed for burnout. With Saviynt’s intuitive workbench, preloaded rulesets can help ease you more easily identify, manage and mitigate SoD violations for financial business processes across a long list of ERP applications. Simply upload and view rulesets for different applications and easily view a description of what each risk entails. You can bundle hundreds of functions together to define risk or create rulesets per your organizational needs, removing risks and entitlements that are not in scope.

Plus, SoD assessments can be run in real-time and can detect all the violations in the system — along with priority, description, and the user associated with it, right down to the finest-grained entitlements. You can then remediate violations by removing conflicting entitlements or roles from users or escalating them for review.

Saviynt machine learning helps ensure SoD compliance. Organizations utilizing Saviynt have prevented up to 36% of SoD violations during the access request process. Historical data, platform analytics, and peer benchmarks feed our AI to help drive actionable authorization decisions, as well.

2. Stay One Step Ahead of Audits

The key to aligning with SOX requirements rests on a CO’s ability to produce an on-demand audit trail that verifies user rights and permissions across the infrastructure. Older systems don’t have the advanced access tracking capabilities you need to understand how a problem occurred — or how to prevent it from happening in the future. And manually reviewing user behavior and auditing access for thousands of users is not practical or sustainable.

The Villains: Complexity, Complexity, Complexity

Identity and Access Management (IAM) policies can keep you SOX compliant by tracking, monitoring, and remediating access across the organization. But as ecosystems evolve into a blend of on-premises, hybrid, and cloud infrastructures and applications, COs face the daunting task of manually managing legacy identity management systems. Within each connected Software-as-a-Service (SaaS) application, you have different data sets. In an ERP environment, you may have to rely on different apps for payroll, accounts payable, and accounts receivable. Each cloud service and application uses its own, internally-defined definition for roles, groups, and other attributes. Even the term “user” differs from one service provider to another. Many applications simply aren’t built for native identity governance and administration (IGA) platform integration — and one-off integrations are cumbersome, time-consuming, and error-prone. This is problematic for audit and compliance teams who routinely onboard applications to IGA platforms and evaluate risks.

The real benefit of an identity solution is both in its seamless platform integration and oversight of Joiner-Mover-Leaver scenarios. However, conducting separate access certification campaigns to eliminate orphaned accounts and verify privileged access is another unmanageable drain on time, manpower, and productivity. Manually managing workforce changes also takes a lot of time and increases risks of improper access.

The Hero: Automation

Saviynt automatically applies your IAM policies across the identity lifecycle — from access requests to workforce changes. Smart reviews and filters automatically approve “low risk” and “no risk” access requests, providing context and insights that help approvers make faster, smarter decisions. COs can also provision, monitor, log emergency access — and immediately revoke it as needed. When change occurs, Saviynt can automatically track and flag excessive permissions, ensuring users have “just enough” access for just the right amount of time to complete their tasks. Emergency access can be time-bound and customized to automatically expire when the session is over, eliminating standing privileges or orphaned identities.

Our Control Center dashboard and reporting functionality drive actionable insights, automate decisions and can generate compliance reports against a wide range of industry-specific requirements, including SOX. With pre-defined reports, your team spends significantly less time digging up audit information and working on data interpretation to get auditors the information they need. The end result is continuous assurance over your least privileged data privacy controls, reduced human error, and lower operational costs.

3. Streamline Your Arsenal

Saviynt brings together five core identity products — IGA, Privileged Access Management, Application Access Governance, Third-Party Access Governance and Data Access Governance. What do they all have in common? Convergence. One dashboard, one unified, automated, superior line of sight.

Compliance is complex enough. To keep their organization free and clear of violations, COs need simplicity and visibility to understand access through the entire ecosystem. They don’t need manual processes and different tools with different rules that fail to integrate. Moving to an automated, centralized system enables greater control over users’ data access, solves many IAM policy headaches, and proves governance more effectively for audits. Saviynt’s continuous reporting capabilities can help you reduce these inefficient, error-prone systems and provide the visibility to achieve peace and be the unsung hero of your organization.

Next up in this series, we’ll show you how COs can clear another major hurdle: an audit by the Federal Financial Institutions Examination Council (FFIEC).