I touched on this topic on a previous post in December, when I mentioned that Andrew Delin from the VSTS Process team was working on a comprehensive whitepaper to be delivered sometime in 2008.
And here it is: Sarbanes-Oxley 404 and Visual Studio Team System 2008. There isn't a one-size-fits-all solution for SOX implementation with TFS, but this paper provides the guidelines that will allow you to sort out the many implementation options. Enjoy.