I am not suggesting that you don't need technology. I am suggesting that FogBugz doesn't offer enough flexibility in their workflow definition to do the gymnas

I am not suggesting that you don't need technology. I am suggesting that FogBugz doesn't offer enough flexibility in their workflow definition to do the gymnastics required for SOC1 compliance. FogBugz is trying to follow best software development practices and as you noted, Jira is a dream-tool for a micro-manager.