We currently use DBGhost to achieve Canadian Bill198 compliance (SOX derivitive). DBGhost scripts off database objects with the exception of DTS (which we use redgate DTS compare) to Visual Source Safe, developers are setup in source safe to check in and out of source safe. DbGhost then looks at source safe and synchronises with the target server, producing a report on the changes made. Simple.
U can also use it for data and schema comparisons btween db's ondifferent servers (say development and qa or qa and production) and then it allows you to synchronise should you wish to.
RedGate cannot integrate with source safe therefore for sox compliance there is no safe source for SQL code control. You would need to tie down the sql server so much that no one has access to it.
We only allow DBA access to production and developers to development. Developers promote to QA with DBGhost but only dba's will promote from QA to production so that segregation of duty issues are complied with....but thats a whole new ball game !!