Security Testing

SOX Compliance Automated Testing Strategies

HelpMeTest

HelpMeTest

— 5 min read
SOX Compliance Automated Testing Strategies

The Sarbanes-Oxley Act (SOX) requires public companies to maintain accurate financial reporting and demonstrate effective internal controls. For software teams, SOX compliance translates to specific IT General Controls (ITGCs) that can — and should — be automated.

SOX and IT General Controls

SOX Section 404 requires management to assess and attest to the effectiveness of internal controls over financial reporting (ICFR). Auditors evaluate ITGCs in four categories:

  1. Access to programs and data — who can access financial systems and data
  2. Computer operations — how systems are monitored and incident response
  3. Program change management — how code changes are controlled and documented
  4. Program development — how new systems are built and tested

Developers are most directly responsible for access controls and change management. Both can be tested automatically.

Access Control Testing

SOX requires that access to financial systems follows least-privilege principles and that privileged access is documented and reviewed.

Testing Principle of Least Privilege

# test/sox/test_access_controls.py
import pytest
from src.auth import get_permissions, create_session

class TestSOXAccessControls:
    """SOX ITGC — Access to Programs and Data"""
    
    def test_financial_data_requires_explicit_permission(self, client):
        """Default users cannot access financial reports without explicit grant"""
        standard_user_token = create_session(role='standard')
        
        response = client.get(
            '/api/financial/reports',
            headers={'Authorization': f'Bearer {standard_user_token}'}
        )
        assert response.status_code == 403, \
            "SOX: Financial data access must be explicitly granted"
    
    def test_privileged_access_logged(self, client, audit_log, finance_token):
        """All privileged access to financial data must be logged"""
        client.get(
            '/api/financial/gl-transactions',
            headers={'Authorization': f'Bearer {finance_token}'}
        )
        
        entries = audit_log.get_entries(
            resource_type='financial',
            event_type='access'
        )
        
        assert len(entries) >= 1
        entry = entries[-1]
        assert entry['user_id'] is not None
        assert entry['timestamp'] is not None
        assert entry['resource'] == '/api/financial/gl-transactions'
    
    def test_no_shared_service_accounts(self):
        """SOX: Each system action must be attributable to an individual"""
        from src.config import get_service_accounts
        accounts = get_service_accounts()
        
        for account in accounts:
            assert account.get('individual_owner') is not None, \
                f"Service account {account['name']} has no individual owner — SOX violation"
    
    def test_terminated_user_access_revoked(self, client):
        """Access for terminated users must be revoked within 24 hours"""
        # This tests the revocation mechanism works, not the actual process
        from src.auth import revoke_user_access, check_active_sessions
        
        user_id = 'test-terminated-user-123'
        revoke_user_access(user_id)
        
        sessions = check_active_sessions(user_id)
        assert len(sessions) == 0, \
            f"User {user_id} still has {len(sessions)} active sessions after revocation"

Segregation of Duties (SoD)

SOX requires that no single individual can initiate and approve a financial transaction:

def test_cannot_approve_own_transaction(client, db):
    """SOX SoD: Users cannot approve transactions they initiated"""
    user_id = 'user-123'
    user_token = create_session(user_id=user_id, role='finance')
    
    # Create a transaction
    create_response = client.post(
        '/api/financial/transactions',
        json={'amount': 50000, 'type': 'expense', 'description': 'Vendor payment'},
        headers={'Authorization': f'Bearer {user_token}'}
    )
    transaction_id = create_response.json()['id']
    
    # Try to approve own transaction
    approve_response = client.post(
        f'/api/financial/transactions/{transaction_id}/approve',
        headers={'Authorization': f'Bearer {user_token}'}
    )
    
    assert approve_response.status_code in (400, 403), \
        "SOX SoD: Creator cannot approve their own transaction"

def test_cannot_create_and_disburse(client):
    """SOX SoD: Users with create permission cannot disburse funds"""
    creator_token = create_session(role='transaction_creator')
    
    create_response = client.post(
        '/api/financial/transactions',
        json={'amount': 10000, 'type': 'disbursement'},
        headers={'Authorization': f'Bearer {creator_token}'}
    )
    transaction_id = create_response.json()['id']
    
    # Creator tries to disburse
    disburse_response = client.post(
        f'/api/financial/transactions/{transaction_id}/disburse',
        headers={'Authorization': f'Bearer {creator_token}'}
    )
    
    assert disburse_response.status_code == 403, \
        "SOX SoD: Transaction creator cannot also disburse"

Change Management Testing

SOX requires that code changes to financial systems follow a documented change management process. Every change must be authorized, tested, and approved before deployment.

Testing Change Authorization

# test/sox/test_change_management.py
import pytest
from src.deployments import get_recent_deployments, get_change_approval

class TestSOXChangeManagement:
    """SOX ITGC — Program Change Management"""
    
    def test_deployments_have_approved_change_requests(self):
        """All production deployments must have an approved change request"""
        deployments = get_recent_deployments(days=30, environment='production')
        
        violations = []
        for deployment in deployments:
            approval = get_change_approval(deployment['id'])
            if not approval or approval['status'] != 'approved':
                violations.append({
                    'deployment_id': deployment['id'],
                    'deployed_at': deployment['deployed_at'],
                    'deployed_by': deployment['deployed_by'],
                    'approval_status': approval['status'] if approval else 'MISSING'
                })
        
        assert len(violations) == 0, \
            f"SOX: {len(violations)} production deployments without approved change requests:\n" + \
            '\n'.join(str(v) for v in violations)
    
    def test_emergency_changes_documented(self):
        """Emergency changes must be documented and reviewed post-deployment"""
        from src.deployments import get_emergency_changes
        
        emergency_changes = get_emergency_changes(days=90)
        unreviewed = [c for c in emergency_changes if not c.get('post_review_completed')]
        
        assert len(unreviewed) == 0, \
            f"SOX: {len(unreviewed)} emergency changes without post-deployment review"
    
    def test_change_requests_have_business_justification(self):
        """Change requests must document business justification"""
        from src.change_management import get_pending_changes
        
        changes = get_pending_changes()
        missing_justification = [
            c for c in changes
            if not c.get('business_justification') or
               len(c['business_justification']) < 50
        ]
        
        assert len(missing_justification) == 0, \
            f"SOX: {len(missing_justification)} change requests without adequate business justification"

CI Change Management Gate

Add a SOX gate to your CI pipeline that prevents deployment without approval:

# .github/workflows/deploy-production.yml
name: Deploy to Production

on:
  workflow_dispatch:
    inputs:
      change_request_id:
        description: 'Approved change request ID'
        required: true

jobs:
  sox-gate:
    runs-on: ubuntu-latest
    steps:
      - name: Verify change request approval
        run: |
          STATUS=$(curl -s -H "Authorization: Bearer ${{ secrets.ITSM_TOKEN }}" \
            "${{ vars.ITSM_URL }}/api/change-requests/${{ inputs.change_request_id }}" \
            | jq -r '.status')
          
          if [ "$STATUS" != "approved" ]; then
            echo "SOX: Change request ${{ inputs.change_request_id }} status is '$STATUS', not 'approved'"
            echo "Production deployment blocked per SOX change management controls"
            exit 1
          fi
          
          echo "Change request approved. Proceeding with deployment."
  
  deploy:
    needs: sox-gate
    runs-on: ubuntu-latest
    steps:
      - name: Deploy
        run: ./deploy.sh production
      
      - name: Record deployment in change management
        run: |
          curl -X POST -H "Authorization: Bearer ${{ secrets.ITSM_TOKEN }}" \
            "${{ vars.ITSM_URL }}/api/change-requests/${{ inputs.change_request_id }}/close" \
            -d '{"status": "implemented", "deployed_at": "'$(date -u +%Y-%m-%dT%H:%M:%SZ)'"}'

Audit Trail Testing

SOX requires immutable audit trails for financial transactions:

# test/sox/test_audit_trails.py

class TestSOXAuditTrails:
    """SOX Section 404 — Audit trail integrity"""
    
    def test_audit_log_is_immutable(self, db, finance_token, client):
        """Audit log entries cannot be modified or deleted"""
        # Create an entry
        client.get(
            '/api/financial/reports',
            headers={'Authorization': f'Bearer {finance_token}'}
        )
        
        entries = db.query("SELECT id FROM audit_log ORDER BY created_at DESC LIMIT 1")
        entry_id = entries[0]['id']
        
        # Try to modify the audit log
        with pytest.raises(Exception):
            db.execute("UPDATE audit_log SET event_type = 'modified' WHERE id = %s", entry_id)
        
        # Verify the entry is unchanged
        entry = db.query("SELECT * FROM audit_log WHERE id = %s", entry_id)[0]
        assert entry['event_type'] != 'modified'
    
    def test_audit_log_captures_all_financial_writes(self, client, db, finance_token):
        """Every write to financial data generates an audit entry"""
        initial_count = db.count("SELECT COUNT(*) FROM audit_log WHERE resource_type = 'financial'")
        
        # Perform a financial write
        client.post(
            '/api/financial/journal-entries',
            json={'debit_account': '1000', 'credit_account': '2000', 'amount': 1000},
            headers={'Authorization': f'Bearer {finance_token}'}
        )
        
        final_count = db.count("SELECT COUNT(*) FROM audit_log WHERE resource_type = 'financial'")
        assert final_count > initial_count, \
            "SOX: Financial write did not generate audit log entry"
    
    def test_audit_entries_have_required_fields(self, db):
        """SOX audit entries must include who, what, when, and from where"""
        entries = db.query("""
            SELECT * FROM audit_log 
            WHERE resource_type = 'financial' 
            ORDER BY created_at DESC 
            LIMIT 100
        """)
        
        required_fields = ['user_id', 'action', 'resource', 'timestamp', 'ip_address']
        
        for entry in entries:
            for field in required_fields:
                assert entry.get(field) is not None, \
                    f"SOX: Audit entry {entry['id']} missing required field '{field}'"

Automated SOX Evidence Package

#!/usr/bin/env python3
# scripts/sox-evidence.py
"""
Generates SOX ITGC evidence package for quarterly audit review.
"""
import json
import subprocess
from datetime import datetime, timedelta, timezone
from pathlib import Path

def generate_sox_evidence(period_days=90):
    evidence = {
        'generated_at': datetime.now(timezone.utc).isoformat(),
        'period_start': (datetime.now(timezone.utc) - timedelta(days=period_days)).isoformat(),
        'period_end': datetime.now(timezone.utc).isoformat(),
        'controls': {}
    }
    
    # Run access control tests
    result = subprocess.run(
        ['pytest', 'test/sox/test_access_controls.py', '-v', '--tb=short', 
         '--json-report', '--json-report-file=sox-access-report.json'],
        capture_output=True, text=True
    )
    
    with open('sox-access-report.json') as f:
        report = json.load(f)
    
    evidence['controls']['access_control'] = {
        'control': 'Access to Programs and Data',
        'tests_run': report['summary']['total'],
        'tests_passed': report['summary']['passed'],
        'tests_failed': report['summary']['failed'],
        'status': 'PASS' if report['summary']['failed'] == 0 else 'FAIL'
    }
    
    # Run change management tests
    subprocess.run(
        ['pytest', 'test/sox/test_change_management.py', '-v',
         '--json-report', '--json-report-file=sox-change-report.json'],
        capture_output=True, text=True
    )
    
    # Compile report
    output_path = Path(f'sox-evidence-{datetime.now().strftime("%Y-Q%q")}.json')
    with open(output_path, 'w') as f:
        json.dump(evidence, f, indent=2)
    
    print(f"SOX evidence package: {output_path}")
    print(f"Access controls: {evidence['controls']['access_control']['status']}")

if __name__ == '__main__':
    generate_sox_evidence()

Summary

SOX compliance testing for developers centers on three areas:

  1. Access controls — least privilege, SoD enforcement, access revocation, and audit logging
  2. Change management — deployment gates requiring approved change requests
  3. Audit trails — immutable, complete logs for all financial data access and modification

The goal is not just passing tests — it's generating evidence. Every test run should produce artifacts retained for auditors. CI pipelines that enforce SOX controls and automatically collect evidence reduce the manual effort of quarterly and annual audit preparation significantly.

Read more