Ah, yes, interpretation is key with SOX, especially as the law itself is so vague.

This is one of the reasons I recommend checking with other departments within your company or the auditors before you go full on into your SOX implementation. Because the things the auditors require will be different depending on who your auditor is and what they think is important.

Another key note that I probably should have mentioned in my article. If your auditor requires something for SOX and you do it, you should be fairly safe from other auditor (and federal court) opinions if you can show proof that you did as the original auditor asked.

As long, of course, as you're actually still obeying the SOX law to the best of your abilities. If you've blantantly gone off the track though, not even saying "Well the auditor said..." will save you.