Re: Sarbanes-Oxley / my opinion ---- ( chapter 2 )

[PaulMmn <PaulMmn@xxxxxxxxxxxxx>]

The main impact of SOX at our company is putting in place a lot of 
controls that we probably should have had anyway, but were always too 
busy to implement.

Over the years we have heard rumours that some of the people who 
mysteriously disappeared from the company ("Did they jump or were 
they pushed?") were 'let go' for improprieties with company funds or 
materials.  Never -major- events from anything the rumour mill 
published, but enough to be noticed.

One enabling reason (IMHO) is that due to a big push for efficiency, 
we downsized the personnel base so that many people wore many hats-- 
including power to cut a PO, authorize the check, print the check, 
delete the PO, delete  reference to the check, etc. etc.

So now the big push is to automate the controls-- one person can 
still wear all of the hats, but there has to be a detailed audit 
trail, complete with manual review and oversight at some point in the 
process, to prevent those nasty little sneaky things from happening.

IT -did- pass its audit (barely, with just a little song and dance 
number, but we passed), and we were -so- proud because some other 
departments didn't.  Nyah!  Does SOX create interdepartmental 
animosity?  So far, it's all been good natured...

And IT is the savior when it comes to implementing new automatic 
controls.  Companies that are forced to hire people to implement the 
controls are definitely at a disadvantage compared with companies 
that have IT departments that understand the systems and can 
implement the controls.

There's just one slight detail that no one has mentioned... and I 
hope the auditors never think about it...  A Security Officer has 
access to -everything- on the system-- every file, every document-- 
everything.  That's why we have every change to production data in 
writing, signed by a manager, and stacked in nice neat rows so we can 
prove someone -else- said it was OK!

TIME magazine had an interesting thought about IT controls years ago. 
One author said, "Ideally, the first step in securing the system is 
to shoot the programmer."

--Paul E Musselman
Paulmmn@xxxxxxxxxxxxxxxxxxxx