How do you document development work for SOX?

Our organization follows the Sarbanes-Oxley Act (SOX). SOX requires us to follow documented controls and keep proof that required development, testing, review, and approval work was completed.

Our SOX process requires developers to:

• Store code and unit test evidence in GitLab.
• Include the related backlog card number.
• add the GitLab link to the backlog card.
• Connect code comments to an approved backlog item.
• Store the code in a repository that requires users to sign in.
• Have a peer or Technical Lead approve each pull request. Developers cannot approve their own pull requests. 

We build agents in Tool Studio. Moveworks and GitLab are not connected. Our developers must manually copy the code and other development records from Moveworks into GitLab.

We want to meet our SOX requirements without creating more manual work than needed. We would like to learn how other Moveworks customers handle this.

How does your organization document this work?

• What Moveworks code or development records do you save?
• Where do you save them?
• Do you use GitLab or another code repository?
• If you use GitLab, how do you copy content from Moveworks into GitLab?
• What information do you include with the code?
• How do you connect the code to a backlog item, change request, or release?
• When do developers add the code and supporting records?
• Who reviews and approves the work?
• Have you automated any part of this process?

Examples, templates, or screenshots would be helpful. Please remove any confidential information before sharing.