Sophos is known to have a high rate for false positive detection, if I recall.

Agree with @Dusty2 you'd want to get in touch with Intuit, who may be able to help you and if they determine that it's a false positive, they may even work with Sophos to update their database.

In the meantime, I'd also scan the file(s) identified on the VirusTotal website, which would give you consolidated results from multiple scanners: https://www.virustotal.com/gui/home/upload