I'd add one thing to Craig's post; SOX isn't just about data - you need the paper trail for code changes too (table/view definitions, stored procedures, functions, triggers, etc.).

Chris