SOX was implemented with COBIT 4, Control Objectives for IT. This introduced a lot of process and cost overhead, so COBIT 5 removed the control objectives -- it's just a list of IT topics. So now, corporations can now comply with SOX by doing nothing.