Ultimately, the external auditor has the final say on compliance requirements.


	Advertise with Sarbanes Oxley Compliance Journal

News

< Back

Sarbanes Oxley : Technology : Thought Leader

Ultimately, the external auditor has the final say on compliance requirements.

Marv Tseu
CEO
Active Reasoning

Most IT organizations have survived their first Sarbanes-Oxley audit. However, it?s not over. Every year IT organizations will be required to demonstrate compliance controls for the infrastructure and software supporting material financial systems. Because Sarbanes-Oxley is an interpretative piece of legislation, it doesn?t explicitly detail requirements for the IT organization.

Ultimately, the external auditor has the final say on compliance requirements. Over the past year, the auditing community has learned more about the IT infrastructure and organization that supports material financial systems. As a result, the auditing requirements will continue to evolve. The criteria used during the 2004 audit may not be the same in 2005 and will create new challenges for the IT organization as they scramble to adapt to new requirements.

As companies plan for subsequent audits, they should continue to focus their efforts on change activities within the underlying applications and technologies supporting key financial systems. By taking a practical approach to compliance and focusing their primary efforts on establishing internal and external change controls, IT organizations can ensure smoother audits in the future.

Specifically, IT organizations should identify and establish change controls for the key directories, files, and processes supporting material financial systems. In addition, they should establish configuration controls for messaging systems that pass transactional data between financial repositories. Finally, internal application controls should be established for important database values and schemas.

Active Reasoning has helped many companies meet their ongoing compliance requirements through its policy-based operations management software that detects, guides, and audits change activities within the IT infrastructure.

About Us

Editorial