XPOs can and do work, but there are some issues using them. From most of what I've researched, when it comes to SOX compliance the best way to migrate code changes is by moving the binary server files - the .aod, .ahd, etc files - that are stored in the application directory of the server. Since these files are the compiled versions of the application code, it is easier to prove that the modifications that were created in a development environment are the same modifications deployed to the production environment. XPOs are plain text and can be manipulated in a text editor, making it more difficult to prove this, though not impossible.
I actually did a writeup of what we have done to manage our code deployments if you are interested. It covers XPO vs Layer file migrations, and ultimately describes our process for automated builds and deployments. Since we put it in place our auditors have been very happy when it comes to auditing our system.