You’re correct; you essentially write your own rules for SOX compliance. SOX audits are to check that you comply with those rules. There’s a lot of wiggle room,

You’re correct; you essentially write your own rules for SOX compliance. SOX audits are to check that you comply with those rules. There’s a lot of wiggle room, and I suspect many hire a consultant that has a general framework of rules you “should” have to get through the initial certification.