Agile SOX

Hi all,

Where I am coaching, there is a powerful and persistent worry and preoccupation with SOX compliance. I am leading a couple of training classes next week and due to this concern, I will be covering this topic. How best to do that? Figure a half hour at most (including Q&A). 

What I have surmised is that part of SOX can be covered in the DoD. And part would be covered in the User Stories as Acceptance Criteria. I also posit that the PO accepting the story might me sufficient for the user acceptance tests, since the PO comes from the business.  

Can someone point me to a few representative samples of these?
What else is there to know? Is there anything outside of stories and DoD that is part of how agile handles SOX?

My goal is to get them to a) worry less because it’s handled and b) not to hamstring themselves into some overkill process and c) make sure they can survive or better, avoid an audit. (Indeed we have a project names Phoenix here :).

Michael