Sarbanes-Oxley is outside of my area of expertise, but my understanding is that the law requires companies to have the proper internal controls in place. For instance you need to know whether
payroll is so out of whack that it affects your financial statements. Therefore you need to have a set of tests and controls in place to make sure employees are paid accruately and that the hours were authorized.