Most good SCM systems (Subversion, Perforce, et al) will keep this kind of information automagically and then it's just a matter of judicious parsing of the output from svn log or the like to produce a report. And you really should be using some form of SCM anyhow, so why bother with the record-keeping yourself?

And condolences on the SOX thing; I've felt and continue to feel said pain. %/