Software, applications and databases utilized to process financial transactions of publicly traded companies, as well as the servers housing these systems are required to be Sarbanes-Oxley compliant. Thus, the accounting system (for example: SAP, Oracle, Dynamit, QuickBooks, etc.), payroll system, corresponding databases or data warehouse, as well as the server housing the application would all be required to be in-scope. Typically the primary domain controller is in scope as well.