SOX on A naive bidder

Automating compliance with SOX, COSO and SCF

Ruben Afonso — Wed, 30 Sep 2026 00:00:00 +0000

In the previous post, Towards Repeatable Compliance, we explored the basics of a generic framework to define compliance requirements, extract controls and execute them as part of a deterministic verification set.

That is useful on its own, but we can do better by aligning each of the components involved with industry standards, gaining better integration and reusing existing patterns.

This post starts from SOX regulation, and introduces a well-known governance framework (COSO), a set of controls (SCF) and a standard format for expressing findings (NIST’s OSCAL).

Towards Repeatable Compliance: The Basics

Ruben Afonso — Tue, 08 Sep 2026 10:00:00 +0200

Problem statement

Most teams store requirements as text scattered across Jira, Confluence and Slack. Every notation invented for them — MoSCoW, EARS, Gherkin — makes a requirement clearer. None makes one checkable: no Jira board can say whether the rule it describes held last March, or which of its own rules has never been tested.

That mattered less when a human read every ticket before writing code. It matters more now that agents do much of that reading: as I argued in The Pull Request Future in the Agentic Era, the leverage is moving upstream, to the requirement itself.