Security Report (or BAQ)

Has anyone built a report that would sufice the SOX's requirements for
a Security Report. This report would need to show, by user, what
access they have and/or don't have access to. This would mainly be at
the menu level and field level.

Thanks