RE: Justification for modifications?

Ron, you're being given incorrect information.

This isn't a SOX mandate.  SOX doesn't even explicitly mention change
management.  See
http://en.wikipedia.org/wiki/Information_technology_controls#The_Sarbane
s-Oxley_Act or any other source on the actual text of the act.

In a nutshell all SOX says is that controls are in place to insure the
confidentiality, integrity, and availability of data.

You're probably reacting to how either your employer or your auditors
are interpreting SOX.  Most if not all interpretations will include
common things like segregation of duties, BCDR, and change management.
Change management will pretty much always include documentation of the
change, including a test plan to verify the change was successful.  No
where does it specify that all groups and all location have to sign off
on the test.  No where does it specify that users and not IT have to do
the testing.

I'm sorry you're knee deep in this.  There's so much BS being tossed
around in the name of SOX and other compliance regulations.


Now then, to address the problem I have three suggestions:

1. Baseball bat, end user, kneecaps.  Not a good career move but you'll
enjoy it.
2. Evaluate the entered value.  When they enter 03/02/2007 calculate it
out to 0.000747 and use that as the quantity.  Hey, you're only giving
them what they asked for.
3. Do input validation against that - and all - fields.  That you're not
doing it already is a sign of a poorly written application.  Folks can
argue all they want but all input - user, file feed, etc. - should be
validated before it is accepted.