RE: RE: Sarbanes-Oxley / my opinion

[Al Mac <macwheel99@xxxxxxxxxxx>]

Other perspectives:

* Compliance with regulations (e.g. OSHA EPA) frequently add cost, where 
the people who must comply often dispute, or feel hostile towards 
motivation behind the regulations, especially if they sense any 
incompetence in those enforcing the regulations.

** I should think that stories of the hell on foreign workers, not 
protected by any health and safety standards, should inspire any person of 
good will to lobby for a system that protects them also, so that their 
employers are less able to compete unfairly with the cost of our protection.

* Some technology has false positives ... so our alarm system has false 
alarms, the police arrive, but there is no break in, and after we have a 
certain # of false alarms in some time period, there are fines imposed ... 
we have the trigger now set that the alarm company calls top executives who 
make the decision whether to do self-policing (gang of employees) before 
calling the real police.  Plus we have had break ins where the alarm system 
got bypassed.

** All  physical break ins so far at my employer (GWT), the burglars were 
clever getting in, but used brute force inside to bust things open, not 
using means such as over false ceilings to get into "locked" places.  I 
wonder how many stockholders might want to know how much of business is 
"secured" in places accessible over false ceilings, behind gates where the 
physical lock hangs unlocked all day.  (Burglars can substitute their lock, 
night crew locks up using burglar lock, they return after no one there, 
unlock their lock, do their thing, lock up using correct lock.)  Plus we 
had employees with desks that cannot be locked.

* There is widespread sense that no person nor company can think of 
everything, so combined with any rules can get broken, what is most 
critical is to have appropriate levels of insurance as protection against 
the unexpected, or expected risk but no know when it might strike  We have 
had insurance companies doing ISO-style questions, where base ISO requires 
that a company with a flawed process, have that process written down and be 
audited to verify they doing the flawed process, but then the written down 
process can be compared to high class practices, and employees asked about 
what is not in the written down stuff.

* Like accounting, IT is an expense burden upon the company, but it is 
small expense compared to if there were no accounting or IT specialists, 
with every employee having to do the stuff that that the accounting and IT 
people do for them.

> midrange-l-request@xxxxxxxxxxxx wrote:
>
> >   3. RE: Sarbanes-Oxley / my opinion (Doug Hart)
> >
> >SOX does not help our company build or sell product but has cost us big
> >bucks.  Tell that to the stock holders.
>
> Out of curiosity, regardless of my employer (PowerTech), I have to ask --
>
> How were stockholders answered when they asked how often company 
> information assets were abused, stolen or altered without authorization 
> and what the losses amounted to? In a physical sense, would stockholders 
> be pleased to know that no one locked doors and there were no alarms in 
> the buildings to notify someone of an overnight break-in?
>
> I would think that if such things were well handled before SOX, then there 
> shouldn't have been a significant cost resulting from SOX.
>
> I know this has sounded confrontational, but I really have little idea (as 
> far as SOX goes for policy implementation). My view is obviously from a 
> very different perspective. I figure that anything I can learn from 
> another perspective gives me a better chance of doing my work better.
>
> Tom Liotta
>
>
> __________________________________________________________________
> Switch to Netscape Internet Service.
> As low as $9.95 a month -- Sign up today at http://isp.netscape.com/register
>
> Netscape. Just the Net You Need.
>
> New! Netscape Toolbar for Internet Explorer
> Search from anywhere on the Web and block those annoying pop-ups.
> Download now at http://channels.netscape.com/ns/search/install.jsp
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.