I've never dealt with SOX compliance personally, but I did deal with PCI compliance. Now, PCI compliance isn't government-mandated, but since the penalty for non-compliance is that they take away your ability to take credit cards, it's treated as though it were a government mandate in a corporate setting. My observation about PCI compliance was the regulations themselves were clear, helpful, and well thought out. The burden was the months upon months spent arguing about who interpreted which regulation which way (and God forbid you just ask the regulators!), and an apparently certifiably insane executive board that would rather spend $1000 avoiding each individual regulation than spend $10 adhering to it.

You're required by to set up systems to ensure accounting information can not be tampered with, even if people tampering with accounting information isn't considered to be a high risk. To make it more concrete, it means you can't push to master any more in a git repository to fix some botched merge because, it happens to deal with revenue in some tiny corner of it's functionality and every change has to be approved by multiple people

In light of git's enforced immutability constraints and the fact that multiple approval for merges is SOP at many large companies, I suspect that isn't a very good analogy.

I thought they meant that literally, and not as an analogy.

At my company, developers can't do production deployments for, I've been told, "SOX compliance".