I agree that SOX overall has been a force for good. I see tighter controls over who has access to data now and a better understanding from non-technical management on the relevance of that.

An interesting effect of SOX I've witnessed is that development of access control & tracing systems, bug fixes & upgrades to in-scope systems are funded & championed more readily. Where SOX is concerned the decision on whether or not to spend money on development is often made simpler for management.

Keith