|
So if neither business nor auditors are competent, who is? -----Original Message----- From: midrange-l-bounces@xxxxxxxxxxxx [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Milt Habeck Sent: Wednesday, April 05, 2006 1:01 AM To: Midrange technical discussion group Subject: Sarbanes-Oxley / my opinion ---- ( chapter 2 ) Good evening, SOX is much broader than fraud and theft, in my opinion .... and it must be to protect shareholders. Yes, it is true that Congress acted in response to the outrage born from the acute fraud/theft at two major enterprises that failed to provoke external audit warnings. But the impetus for the legislation did not end up defining what SOX became. That definition was created by the Public Company Accounting Oversight Board (PCAOB - or "Peek-a-Boo") that was empowered by Congress to interpret the requirements of the legislation .... much like the IRS is empowered to interpret tax legislation and does so by creating endless pages of regulations. An executive overview of what PCAOB ended up doing is reported here: http://www.unbeatenpathintl.com/pcaob/source/1.html Interestingly enough, after reading all 216 pages of SOX regulations authored by PCAOB, the only three practical illustrations I found directed auditor's attention to an infinitesimal level of internal control detail (see the URL) that had nothing to do with either fraud or theft ... rather, the focus was on world class business practice. By the way, I couldn't find the word "computer" in the PCAOB material ... I think the big emphasis on computers was invented by external auditors as a billing expansion strategy. Now ... brace yourself for a strongly held opinion. If you added up all the theft at Enron + Worldcom + Parmalat + other headline disasters, the value of the losses would be very small (maybe trivial) relative to the losses suffered by shareholders every year due to poor business practice. That's what PCAOB is targeting and, if anyone pays attention, that shall be a far better protection for shareholders. Permit me to express a comment based on personal observations in a broad variety of industries located around the world: There is what I would call a pervasive (not universal) "myth of business competence." I have seen very hard working, involved, motivated, loyal employees at all corporate levels in big and small companies who don't understand the distinctions between what they are doing and world class business practice. +> The cost of those distinctions is staggering. +> Senior management attention to the distinctions is unlikely. +> The budget to address those distinctions is generally non-existent. So, now Congress and Peek-a-Boo are relying on external auditors to find and disclose the distinctions. Here comes another strongly-held point of view: with a notable early 90's exception at AA in Argentina, the external auditors I've personally worked with aren't up to the task ... and that includes the recent college grads walking around with questionnaires on clip-boards right on up to the partners. I refer to that as the "myth of auditing competence." Net point: shareholders have much more to worry about than theft/fraud and, sadly, the paucity of SOX comments in annual report audit letters suggests that the "myth of business competence" remains alive and well despite the PCAOB regulations. Warm regards, Milt Habeck Founder/President Unbeaten Path International www.upisox.com North America: (888) 874-8008 International: (262) 681-3151 "Unbeaten Path is in the business of helping enterprises move towards world class performance." +++++++ +++++++ +++++++ +++++++ +++++++ +++++++ From: John Earl To: Midrange Systems Technical Discussion Sent: Tuesday, April 04, 2006 7:28 PM Subject: Sarbanes-Oxley / my opinion > I suppose my three immediate questions would be: > 1. What is SOX intended to prevent? Fraud and theft, no more, no less. When you examine it closely, SOX really is an ingeniously crafted piece of legislation. Rather than creating long lists of "You Must" clauses followed by "we will Check on you by..." statements (and a gigantic federal bureaucracy to match), SOX simply says to the CEO and CFO "You will sign a letter stating that you have adequate financial controls in place to prevent fraud and theft. If you sign that letter and you're wrong, you could go to jail". Brilliant! (See a nice summary of SOX Section 404 at http://www.aicpa.org/info/sarbanes_oxley_summary.htm) Congress simply told the head honcho's that it is their butts that are on the line. The head honcho's have always had the where-with-all to turn the organization towards security and best practices, all Congress did was give them the motivation. :) Now the Honcho's have to take a critical eye at the organization and ask themselves... "If, under our current operating practices, Rocko on the shipping Dock can steal a semi truck full of widget's and nobody would even know they are gone, or Jane in IT could open up a hole for Tom in AP to pay himself 7 digit's as a phony vendor, and there is no way to capture that, AND I don't deploy the organizations resources in such a way that I could stop (or at least detect) those actions, I could go to jail." All of the sudden, the Honcho's want adequate controls in place. If you were in their shoes, you would too. And I know from personal experience that if you take an average production iSeries system with, say 800 users on it, somewhere between 25% - 100% of those users could rob the place blind because there are little, or no, controls deployed to prevent this. In the old days, we all used to just wink at each other and say "Aww... Our users are too {(A) Nice, B) Honest, C) Stupid, D) Busy, E) Select your own adjective }, they are not going to steal from us". Today the CEO and CFO look at those 800 people and say "I guess they probably won't steal from us - but if I guess wrong, I could face criminal charges". And all of the sudden they start viewing system security differently. They start orientating themselves to the same posture that IT Security professionals have had all along - "Nobody gets access on less they absolutely need it." You, the System Admin, may think this is useless and wasteful, but get used to it because it is the future of computing. > 2. How effective is it at actually enforcing what it's > intended to > prevent? As effective as the CEO wants it to be - everyone has a pain tolerance - at some point the CEO will decide that there are enough controls in place that he/she stands a high chance of _not_ going to jail, and will ease up (a bit). Personally I think SOX already is very, very effective, because the folks who have the highest ability to influence the outcomes (Honcho's) have the most skin in the game. Again, this part was pure brilliance. > 3. What are the new methods of circumventing it? Remember, SOX does not say how to secure your iSeries (or any other system). It does not state an opinion on what QSECURITY level you should be at, or what your Password Change Interval should be. It just says that you must have adequate controls in place, and you must get an external auditor to agree with you (in writing) that there are adequate controls in place. All of the auditors are playing this one very nervously because they remember what happened to Arthur Anderson. (An Arthur Anderson "Partner" lied, and committed other crimes, in an effort to cover up Enron's financial misdeeds. Because he was a "Partner", the entire corporation was liable for his crimes, and so the company was convicted of a felony. Felons are not allowed to hold corporate charters, and so on the very day that Arthur Anderson was convicted of a felony, it lost its license to do business as a corporation. On that day a 100+ year old icon of American business just ceased to exist.) So there is no _one_ way to "circumvent SOX. You have (or should have) a security policy, and then you should manage your business according to that policy. Your auditors will generally be happy if they can measure your adherence to your own written policy, and grade you on how well you are doing what you said you would do. That is the essence of SOX. Do good things. Manage your company so that people can not steal from the business without being detected. If you do this, you are well on your way to SOX Compliance. If you don't do this, maybe you ought not to be the one running the business (or its IT assets)? JMHO, jte +++++++ +++++++ +++++++ +++++++ +++++++ +++++++ +++++++ From: Milt Habeck To: Midrange technical discussion group Sent: Tuesday, April 04, 2006 11:30 AM Subject: Sarbanes-Oxley / my opinion In my opinion, Sarbanes-Oxley compliance doesn't require an enterprise to do anything that good business practice did not already require a couple of decades ago. SOX just requires that external auditors do a more thorough job looking for distinctions between world class business practice and how a company actually operates ... and ... it requires that the auditors report those distinctions for review by investors. It's not clear how well the "report-it-to-the-investors" part of the legislation is working. If anyone knows of an annual report that has included a SOX-type complaint in an audit letter, please tell me more about it. If annual reports of that genre can't be found, then we're left with two hypotheses: 1. Thousands of publicly traded companies are doing a great job running their business with sound internal control regimens in all functional areas (including IS). 2. The fear of annoying a client and not being invited to perform next year's audit has proved to be more compelling than the fear of failing to observe the letter of Sarbanes-Oxley. [Quite candidly, it's hard to believe hypothesis #1 given the testimonies I've personally heard from managers across a broad cross section of manufacturing industries.] Long before SOX was invented, pharmaceutical companies had much more demanding business practice requirements imposed by the FDA. If your enterprise could get system-certified under FDA's 21 CFR part 11 rules, SOX would be a cake-walk. There are several other IT compliance requirements that pre-date SOX and here's a link to information about the better known ones: http://www.unbeatenpathintl.com/ITstandards/source/1.html You mention BRMS (Business Rule Management System) software and that genre of tool can help an enterprise develop and maintain operational policies. But, it's not going to help much if the purchaser doesn't already grasp what world-class business practices are supposed to look like. Without that intellectual property, the final deliverable won't help improve the quality of operations any more than many of the ISO 900x policy books I've seen. (I'm referring to the "just-write-down-what-we-are-already-doing-so-we-can-pass- the-ISO-audit-ASAP" type efforts.) Warm regards, Milt Habeck Founder/President Unbeaten Path International www.upisox.com (888) 874-8008 "Unbeaten Path is in the business of helping enterprises move towards world class performance."
As an Amazon Associate we earn from qualifying purchases.
This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].
Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.