I've never dealt with SOX compliance personally, but I did deal with PCI compliance. Now, PCI compliance isn't government-mandated, but since the penalty for non-compliance is that they take away your ability to take credit cards, it's treated as though it were a government mandate in a corporate setting. My observation about PCI compliance was the regulations themselves were clear, helpful, and well thought out. The burden was the months upon months spent arguing about who interpreted which regulation which way (and God forbid you just ask the regulators!), and an apparently certifiably insane executive board that would rather spend $1000 avoiding each individual regulation than spend $10 adhering to it.