Compliance · Sarbanes-Oxley (SOX)
Sarbanes-Oxley and Financial Record Custody
SOX is a controls regime. Auditors test whether a control operated, not whether it was described. A custody record showing that every rotation happened on schedule is the kind of evidence that survives testing.
Bring your retention schedule. We will tell you what it actually costs to meet it.
Read this first. This page is general background on how physical custody supports a compliance programme. It isnot legal advice, it does not state retention periods, and it does not certify that any arrangement satisfies any rule. Requirements change and vary by firm. Get the answer from your own counsel or compliance officer, then tell us what you need us to do.
Scope
Who this applies to
Public companies, their auditors, and the accounting firms and contractors that support them.
The recurring themes
- Retention of financial records and the workpapers supporting them.
- Controls that can be evidenced as having operated, not merely documented.
- Restricted and accountable access to records.
- Disposal that is controlled rather than incidental.
Our part
What custody actually contributes
- Scheduled rotation that produces a scan record every cycle — the evidence a control operated.
- Restricted access with named authorised parties; no staff member can open a client box alone.
- Witnessed destruction with serialised certificates at end of retention.
- A separate, hardened site for duplicate records.
Said plainly
What we do not do
We do not design, assess, or attest to your controls. We produce custody evidence that your controls can rely on. Your auditors decide whether the control is adequate.
Common questions
- Do you provide evidence for audit testing?
- Yes — custody and rotation history for any item we hold.
- Do you assess our controls?
- No. We are a custodian, not an assessor, and a vendor assessing the control it participates in would be worthless anyway.
- Can retention schedules differ by record type?
- Yes. Supply the schedule and we will hold and flag against it.
Bring your retention schedule.
We will tell you plainly what custody covers and what it does not. That is a more useful conversation than a compliance claim.