SOX Compliance

┌─────────────────────────────────────────────────────────────────────────────┐
│                        IT GENERAL CONTROLS                                   │
└─────────────────────────────────────────────────────────────────────────────┘

┌─────────────────┐   ┌─────────────────┐   ┌─────────────────┐
│ Access Controls │   │ Change Mgmt     │   │ IT Operations   │
│                 │   │                 │   │                 │
│ - User access   │   │ - Change control│   │ - Job scheduling│
│ - Auth methods  │   │ - Testing       │   │ - Backup/restore│
│ - Privileged    │   │ - Approvals     │   │ - Monitoring    │
│   access        │   │ - Documentation │   │ - Incident mgmt │
└─────────────────┘   └─────────────────┘   └─────────────────┘

┌─────────────────┐   ┌─────────────────┐
│ Program Dev     │   │ Computer Ops    │
│                 │   │                 │
│ - SDLC process  │   │ - Physical sec  │
│ - Code review   │   │ - Environmental │
│ - Testing       │   │ - DR planning   │
│ - Deployment    │   │ - Capacity mgmt │
└─────────────────┘   └─────────────────┘

┌─────────────────────────────────────────────────────────────────────────────┐
│                     SEGREGATION OF DUTIES MATRIX                             │
├─────────────────────────────────────────────────────────────────────────────┤
│ Function              │ Developer │ Tester │ DBA │ Operations │ Security   │
├───────────────────────┼───────────┼────────┼─────┼────────────┼────────────┤
│ Develop code          │     ✓     │   -    │  -  │     -      │     -      │
│ Test code             │     -     │   ✓    │  -  │     -      │     -      │
│ Deploy to production  │     -     │   -    │  -  │     ✓      │     -      │
│ Modify DB schema      │     -     │   -    │  ✓  │     -      │     -      │
│ Approve changes       │     -     │   -    │  -  │     -      │     ✓      │
│ Review access         │     -     │   -    │  -  │     -      │     ✓      │
└─────────────────────────────────────────────────────────────────────────────┘

// Access request and approval workflow
interface AccessRequest {
  requestId: string;
  requestor: string;
  targetUser: string;
  accessType: 'application' | 'database' | 'infrastructure';
  role: string;
  justification: string;
  startDate: Date;
  endDate?: Date;  // For temporary access
  status: 'pending' | 'approved' | 'denied' | 'revoked';
}

interface AccessApproval {
  requestId: string;
  approver: string;
  approverRole: 'manager' | 'data_owner' | 'security';
  decision: 'approve' | 'deny';
  comments: string;
  timestamp: Date;
}

// Quarterly access review
interface AccessReview {
  reviewId: string;
  reviewPeriod: string;
  reviewer: string;
  users: {
    userId: string;
    currentAccess: string[];
    appropriateAccess: boolean;
    action: 'retain' | 'modify' | 'revoke';
    justification: string;
  }[];
  completedDate: Date;
  attestation: string;
}

┌─────────────────────────────────────────────────────────────────────────────┐
│                        CHANGE CONTROL WORKFLOW                               │
└─────────────────────────────────────────────────────────────────────────────┘

┌──────────┐   ┌──────────┐   ┌──────────┐   ┌──────────┐   ┌──────────┐
│ Request  │──▶│ Approve  │──▶│ Develop  │──▶│  Test    │──▶│ Approve  │
│ Change   │   │ (Manager)│   │          │   │          │   │ (CAB)    │
└──────────┘   └──────────┘   └──────────┘   └──────────┘   └──────────┘
                                                                  │
                                                                  ▼
┌──────────┐   ┌──────────┐   ┌──────────┐   ┌──────────┐   ┌──────────┐
│  Close   │◀──│ Verify   │◀──│ Deploy   │◀──│ Approve  │◀──│ Schedule │
│          │   │          │   │(Ops only)│   │ (Owner)  │   │          │
└──────────┘   └──────────┘   └──────────┘   └──────────┘   └──────────┘

## Change Request: CR-2024-0123

**Title:** Update payment processing module
**Type:** Enhancement
**Priority:** High
**Requested By:** Finance Team
**Request Date:** 2024-01-15

### Description
Update payment processing to support new payment gateway API version 3.0

### Business Justification
Current API version 2.0 will be deprecated on 2024-06-01

### Risk Assessment
- **Impact:** High (affects all payment transactions)
- **Likelihood:** Medium (thorough testing planned)
- **Risk Level:** Medium

### Test Plan
1. Unit tests for new API integration
2. Integration tests with sandbox environment
3. UAT with Finance team
4. Performance testing

### Rollback Plan
Revert to API version 2.0 configuration, restart services

### Approvals
| Role | Name | Date | Decision |
|------|------|------|----------|
| Manager | John Doe | 2024-01-16 | Approved |
| Data Owner | Jane Smith | 2024-01-17 | Approved |
| CAB | Weekly Meeting | 2024-01-20 | Approved |

### Deployment
- **Scheduled:** 2024-02-01 02:00 UTC
- **Deployed By:** Operations Team
- **Verified By:** QA Team
- **Closed:** 2024-02-01

interface FinancialAuditEntry {
  entryId: string;
  timestamp: Date;

  // User context
  userId: string;
  userName: string;
  userRole: string;
  ipAddress: string;

  // Transaction details
  transactionType: 'create' | 'modify' | 'delete' | 'approve' | 'post';
  entityType: 'invoice' | 'payment' | 'journal_entry' | 'account';
  entityId: string;

  // Change details
  previousValues?: Record<string, any>;
  newValues?: Record<string, any>;
  amount?: number;
  currency?: string;

  // Approval chain
  approvers?: {
    userId: string;
    role: string;
    timestamp: Date;
    decision: string;
  }[];
}

// Ensure audit trail integrity
class ImmutableAuditLog {
  private hashChain: string = '';

  async append(entry: FinancialAuditEntry): Promise<void> {
    const entryWithHash = {
      ...entry,
      previousHash: this.hashChain,
      hash: await this.computeHash(entry),
    };

    // Write to append-only storage
    await this.storage.append(entryWithHash);

    // Update hash chain
    this.hashChain = entryWithHash.hash;
  }
}

# Automated evidence collection
evidence_collection:
  schedule: quarterly

  access_controls:
    - user_listing_with_roles
    - new_user_approvals
    - terminated_user_verification
    - privileged_access_review

  change_management:
    - change_tickets_with_approvals
    - deployment_logs
    - code_review_records
    - test_results

  operations:
    - backup_completion_logs
    - restore_test_results
    - monitoring_alerts
    - incident_tickets

  output:
    format: pdf
    storage: secure_archive
    retention: 7_years

// Validation for financial data entry
interface FinancialInputValidation {
  // Range checks
  validateAmount(amount: number, min: number, max: number): boolean;

  // Format checks
  validateAccountNumber(account: string): boolean;

  // Existence checks
  validateAccountExists(accountId: string): Promise<boolean>;

  // Authorization checks
  validateUserCanPost(userId: string, amount: number): Promise<boolean>;

  // Duplicate checks
  validateNotDuplicate(transaction: Transaction): Promise<boolean>;
}

// Three-way match for invoices
async function threeWayMatch(
  purchaseOrder: PurchaseOrder,
  receipt: GoodsReceipt,
  invoice: Invoice
): Promise<MatchResult> {
  const tolerancePercent = 0.02; // 2% tolerance

  const poAmount = purchaseOrder.totalAmount;
  const receiptAmount = receipt.receivedAmount;
  const invoiceAmount = invoice.totalAmount;

  // Check quantities match
  if (receipt.quantity !== purchaseOrder.quantity) {
    return { matched: false, reason: 'Quantity mismatch' };
  }

  // Check amounts within tolerance
  const amountVariance = Math.abs(invoiceAmount - poAmount) / poAmount;
  if (amountVariance > tolerancePercent) {
    return { matched: false, reason: 'Amount exceeds tolerance' };
  }

  return { matched: true };
}