Two ways that take a case statement out of your controller.

example_a.rb

class UserConroller
  def index
    @users = User.sort_by(params[:sort_by])
  end
end

class User
  def sort_by(sort_by)
    case sort_by
      :created_at order(:created_at)
      :last_updated order(:last_updated)
      else order(:id)
    end
  end
end

example_b.rb

class UserController
  def index
    @users = user.order(params[:sort_by] || :id)
  end
end

Yeah. I may have fucked up the case syntax. I never use it and was too lazy to look it up. Hopefully it's still clear what the heck I'm blathering about. Your exclusivity point is well made.