Tier B · can be used in your compliance program

SOX-aligned document retention on Microsoft 365

Controlled change, audit-log evidence, and retention for financial-controls documentation.

The product provides document-governance capabilities — controlled retention with expiration metadata and archive, a complete audit log, and versioning — that organizations can use in their Sarbanes-Oxley (SOX) program for financial-controls documentation. The product is not positioned as a certified SOX solution; fit with your specific SOX program is your compliance and internal-audit team’s responsibility.

Book a free assessment

What SOX asks from document management

The Sarbanes-Oxley Act of 2002 and its implementing regulations have two direct touch-points on documented information:

Section 404 — management’s assessment of internal controls over financial reporting (ICFR). This requires documented controls, documented process narratives, documented risk-and-control matrices, and documented evidence of control execution. Auditors review these documents during the Section 404 audit.

Section 802 — record retention. Specifically, §802 criminalizes the destruction or alteration of records relevant to federal investigations. Public companies subject to SOX retain a defined body of financial records for statutory periods (generally seven years, though scope varies).

For the documented-information layer SOX generates — control narratives, policies, procedures, evidence of control operation — a defensible document-management system needs to demonstrate three things:

  1. Controlled change. Every revision to a control narrative or financial-controls policy goes through a defined approval process, and the before-and-after states are preserved.
  2. Audit evidence. The history of each document — who approved, when, against which version — is retrievable on demand.
  3. Retention discipline. Documents aren’t silently deleted. Superseded versions are preserved. Retention periods are respected.

docs365.ai provides capabilities in all three areas that customers use as part of their SOX program.

How the product’s capabilities align

Controlled change

Capability. Sequential approval with role-based routing. For financial-controls documents, fixed approvers (Financial Controls Manager, SOX Program Lead, CFO) can be configured at the document-type level so the sign-off chain is enforced rather than remembered. Documents are checked out during approval — no edits during the flow — so approvals apply to an unambiguous version.

Audit evidence

Capability. Every document action is written to the audit log against a named Microsoft Entra (Azure AD) user. For SOX-scoped documents, the audit log produces the “who approved what, when, and against which version” evidence that SOX auditors commonly request during Section 404 walkthroughs and testing.

Retention discipline

Capability. Archive (not delete) of superseded documents. Versioning preserves every prior version. Expiration metadata flags documents for review on the cadence the customer configures — rather than letting documents silently age out.

At the tenant level, Microsoft Purview retention policies provide the seven-year retention backbone for financial-reporting-adjacent content. The product’s archive discipline keeps the active library clean while preserving the historical record for the retention period.

What a SOX testing cycle looks like with this

Consider the annual testing cycle for a key IT general control: change management over financial-reporting systems. The control owner — typically in IT Operations — maintains a Change Management Procedure document that SOX testers review annually.

Year 1 authoring. The control owner drafts the procedure from the IT Procedure template. Version 0.1 → 0.2 → 1.0 through a sequential approval flow ending with the SOX Program Lead and the Director of Internal Audit as fixed approvers. Published. Effective date set to January 15.

Year 1 testing (Q3). The SOX tester reviews the procedure. She asks to see the approval history — the audit log produces who signed off, when, in what role. She verifies the current version matches the walkthrough observations. Evidence captured.

Year 2 revision. A system change in Q2 of Year 2 prompts a procedure update. The control owner drafts version 1.1 through the same approval flow. Version 1.0 is archived on publication of 2.0. The archive preserves the document exactly as it was during the Year 1 test period.

Year 2 testing (Q3). The SOX tester reviews the procedure. She verifies both that the procedure was version 1.0 during January–June of Year 2, and that version 2.0 is in effect from July onward. Both versions are retrievable from the library. The audit log shows the full transition — author, approvers, publication, archive.

Year 3 (external audit). The SOX auditor reviews the current procedure and reviews the historical change. Every question — when was the version change, who approved it, what was the prior version, was there a gap in control operation — is answerable from the document’s audit log and the archived prior version.

This is what “defensible under SOX testing” means operationally. No emails to chase. No spreadsheets to reconcile. The document is the evidence.

What the product doesn’t do for SOX

It’s not a GRC platform. It does not manage SOX controls as structured objects, does not run control-testing workflows, does not generate executive-dashboard views of SOX-control status. For those, GRC platforms (AuditBoard, Workiva, OneTrust GRC, ServiceNow IRM) are purpose-built.

It does not perform SOX testing. Testing — the actual examination of evidence against control design — is conducted by internal audit or by external assessors.

It does not determine the scope of SOX controls. Scoping is conducted by management with external auditor consultation.

What it does is provide a disciplined library for the documented information that SOX generates — procedures, policies, control narratives, process documentation. The documentation layer, done well, in the same Microsoft 365 tenant the rest of the organization already operates in.

FAQ

Does Purview handle this already? Purview provides tenant-wide retention, labeling, and records management. It’s the right tool for broad content-retention policies across email, OneDrive, SharePoint, and Teams. It doesn’t provide document-specific approval workflows, per-document audit trails, or active expiration reminders — which is where the product fits alongside Purview. A customer using both gets tenant-wide retention baseline from Purview and document-lifecycle control from the product.

What about ICFR documentation specifically? ICFR documentation — process narratives, flowcharts, risk-and-control matrices — typically lives as Word documents, Excel matrices, or Visio flowcharts. The product’s support for Word, PowerPoint, Excel, and PDF covers most ICFR authoring formats. Visio is not a primary document type; customers typically convert Visio artifacts to PDF for controlled distribution.

Is there a SOX certification for the product? SOX doesn’t have a product-certification scheme. What matters is whether the product supports the issuer’s ability to document and evidence their internal controls. The product provides capabilities that customers use in their SOX programs; the customer’s compliance and internal-audit team verifies fit with their specific program.

Is this adequate for Section 404(b) auditor testing? Adequacy is determined by the external auditor against the customer’s specific controls and evidence. What the product does is produce the kind of evidence — version history, approval audit trail, archive of prior versions, documented expiration and re-review — that external auditors commonly work with.

What about SEC rule 17a-4 (broker-dealer record retention)? 17a-4 has WORM (Write-Once-Read-Many) requirements that go beyond general SOX documentation. Customers in 17a-4 scope typically use specialized archival solutions for the 17a-4-specific records, and the product for their broader documented-information library.

Ready to align your SOX documentation?

Book a free assessment — 30 minutes, no cost. We’ll walk through your current SOX-scoped documentation library and identify where this product’s capabilities would change the evidence shape.

Ready to align your SOX documentation?

Thirty minutes. No cost. No obligation. We'll walk through your current library and identify where this product would change the evidence shape.

Book a free assessment or see all compliance pages