How COBIT helps you achieve SOX Compliance

First released way back in 1996, COBIT has already been around for quite a while. One reason why it never took off was because companies were never compelled to use it ? until now. Today, many CEOs and CIOs are finding it to be a vital tool for achieving SOX compliance in IT.

Thanks to SOX, COBIT (Control Objectives for Information and related Technology) is now one of the most widely accepted source of guidance among companies who have IT integrated with their accounting/financial systems. It has also gained general acceptability with third parties and regulators. But how did this happen?

Role of control frameworks in SOX compliance

You see, the Sarbanes-Oxley Act, despite having clearly manifested the urgency of establishing effective internal controls, does not provide a road map for you to follow nor does it specify a yardstick to help you determine whether an acceptable mileage in the right direction has already been achieved.

In other words, if you were a CIO and you wanted to find guidance on what steps you had to take to achieve compliance, you wouldn’t be able to find the answers in the legislation itself.

That can be a big problem. Two of your main SOX compliance obligations as a CEO or CIO is to assume responsibility in establishing internal controls over financial reporting and to certify their effectiveness. After that, the external auditors are supposed to attest to your assertions. Obviously, there has to be a well-defined basis before you can make such assertions and auditors can attest to anything.

In the language of auditors, this ?well-defined basis? is known as a control framework. Simply put, once you certify the presence of adequate internal controls in your organisation, the external auditor will ask, ?What control framework did you use??

Knowing what control framework you employed will help external auditors determine how to proceed with their evaluations and tests. For your part, a control framework can serve as a guide to help you work towards specific objectives for achieving compliance. Both of you can use it as a common reference point before drawing any conclusions regarding your controls.

But there are many control frameworks out there. What should you use?

How SOX, COSO, and COBIT fit together

Fortunately, despite SOX?s silence regarding control frameworks, you aren’t left entirely to your own devices. You could actually take a hint from the SEC and PCAOB, two of the lead organisations responsible for implementing SOX. SEC and PCAOB point to the adoption of any widely accepted control framework.

In this regard, they both highly endorse COSO, a well-established internal control framework formulated by the Committee of Sponsoring Organisations of the Treadway Commission (COSO). Now, I must tell you, if you’re looking specifically for instructions pertaining to IT controls, you won’t find those in COSO either.

Although COSO is the most established control framework for enterprise governance and risk management you’ll ever find (and in fact, it’s what we recommend for your general accounting processes), it lacks many IT-related details. What is therefore needed for your IT processes is a framework that, in addition to being highly aligned with COSO, also provides more detailed considerations for IT.

This is where COBIT fits the bill.

How COBIT can contribute to your regulatory compliance endeavors

COBIT builds upon and adheres with COSO while providing a finer grain of detail focused on IT. You can even find a mapping between COBIT IT processes and COSO components within the COBIT document itself.

Designed with regulatory compliance in mind, COBIT lays down a clear path for developing policies and good practice for IT control, thus enabling you to bridge the gap between control requirements, technical issues, and business risks.

Some of the components you’ll find in COBIT include:

IT control objectives

These are statements defining specific desired results that, as a whole, characterise a well-managed IT process. They come in two forms for each COBIT-defined IT process: a high-level control objective and a number of detailed control objectives. These objectives will enable you to have a sense of direction by telling you exactly what you need to aim for.

Maturity models

These are used as benchmarks that give you a relative measurement stating where your level of management or control over an IT process or high-level control objective stands. It serves as a basis for setting as-is and to-be positions and enables support for gap analysis, which determines what needs to be done to achieve a chosen level. Basically, if a control objective points you to a direction, then its corresponding maturity model tells you how far in that direction you’ve gone.

RACI charts

These charts tell you who (e.g. CEO, CFO, Head of Operations, Head of IT Administration) should be Responsible, Accountable, Consulted, and Informed for each activity.

Goals and Metrics

These are sets of goals along with the corresponding metrics that allow you to measure against those goals. Goals and metrics are defined in three levels: IT goals and metrics, which define what business expects from IT; process goals and metrics, which define what the IT process should deliver to support It’s objectives; and activity goals and metrics, which measure how well the process is performing.

In addition to those, you’ll also find mappings of each process to the information criteria involved, IT resources that need to be leveraged, and the governance focus areas that are affected.

Everything is presented in a logical and manageable structure, so that you can easily draw connections between IT processes and business goals, which will in turn help you decide what appropriate governance and control is needed. Ultimately, COBIT can equip you with the right tools to maintain a cost-benefit balance as you work towards achieving SOX compliance.

Check our similar posts

Advanced Business Management

Our consultants are highly trained to provide complex management solutions and strategy planning for your business. You can count on us to improve performance and your business skills, while cutting costs.

We ensure full support in a broad range of business management areas, such as:

Business Strategy

Knowing how and when to make the right strategic move is critical to your success in today?s dynamic environment. Our Strategic Management Consultants provide solutions for a tighter integration of your vision, values, and mission statements with the strategic management process.

The result is a stronger alignment of your operating activities with your goals, and also an improved internal infrastructure to support and manage the strategic management process.

Business Process Improvements

In our years of activity, we have developed a robust process to ensure Business Process Improvements projects are implemented successfully. To achieve a positive outcome a number of factors must exist and we?ll make sure your company manages to get the right mix of: sponsorship management and commitment, process improvement goals, right motivations, cultural issues management, provision of adequate resources and funding, and availability of standards and procedures.

Performance Management

An effective performance management system integrates all aspects of the organisation from a shared vision, through a common language, and establishes a culture of accountability and results. It provides more of a holistic way of managing your organization that is more powerful than its individual parts, and without forsaking the values of the organisation.

Change Management Services

Economic downturns, fast rising new competitors, and even climate change, can force companies to scale down, engage in mergers & acquisitions, or transfer to a new location. We?ll help you through every step of the change process, from: evaluating the required change by conducting diagnostics such as change complexity, causal, structural, and context analysis, managing stakeholders including your sponsors, top executives, managers, and personnel, planning for the change, and managing the change process itself.

Project Management

Whether you need help for a single project or much more, we’ve got you covered. With us you get a coordinated, presence-of-mind approach to project management that will point all of your projects to an overall strategic direction, no matter how complex or simple these might be. Our services incorporate all project-related activities including: programme management, project risk management, project review and audit, project rescue, and project governance.

Interim Management

Our resources have an MBA and/or professional accounting qualifications with an average of 10 ? 30 years of progressive work experience with public companies, in complex private equity environments, and/or privately-held middle market companies. We not only offer the most highly qualified project / interim resources to our clients, but we also allow for an interim-to-hire provision in our contracts.

It has proved mutually beneficial to our consultants and clients to have the option for longer term employment opportunities after having worked together on a project / interim basis.

 

Data Leakage Prevention – Protecting Sensitive Information

When DuPont lost $400 million in intellectual property, it wasn’t because a hacker from the other side of the world infiltrated their system. The information was simply stolen by a former employee. Alarmingly, data loss incidents are not always caused by deliberate actions.

A file containing personal information accidentally attached to an email and sent to multiple recipients; financial data stored in a USB pen drive, accidentally left in a restaurant; or bank account data of colleagues, inadvertently posted on a company website – these are also some of the everyday causes of data loss.

A report done by research company Infowatch regarding global data leaks in 2010 showed that there were actually more accidental data leaks in that year compared to intentional ones. Accidental leaks comprised 53%, while intentional leaks comprised 42% (the rest were unidentified).

But even if they ?only? happened accidentally, breach incidents like these can still be very costly. The tens of thousands of dollars that you could sometimes end up paying in civil penalties (as in the case when you lose other people?s personal information) can just be the beginning. More costly than this is the loss of customer and investor confidence. Once you lose those, you could consequently lose a considerable portion of your business.

Confidential information that may already be leaking out right under your nose

With all the data you collect, process, exchange, and store electronically every day, your IT system has surely now become a storehouse of sensitive information. Some of them, you may be even taking for granted.

But imagine what would happen if any of the following trade secrets fell into the wrong hands: marketing plans, confidential customer information, pricing data, product development strategies, business plans, supplier information, source codes, and employee salaries.

These are not the only kind of data that you should be worried about. You could also get into trouble if your sloppy IT security fails to protect employee or client personal information such as their names; social security numbers; drivers license numbers; or bank account numbers and credit/debit card numbers along with their corresponding PINs.

In some countries, you could face onerous data breach notification requirements and heavy fines when these kind of data are involved.

There are now more holes to plug

It’s not just the different varieties of sensitive electronic information that you have to worry about. Because these data can take on different forms, i.e. data-at-rest, data-in-motion, and data-at-the-endpoints, you also need to take aim at different areas in your IT system.

Sensitive information can be found ?at rest? in each of your employees? hard disks, in your servers, storage disks, and in off-site backup disks. They can also be found ?in motion? in email, instant messaging, social networking messaging, P2P file sharing, ftp, http, and so on.

That’s not all. Your highly mobile workforce may have already introduced yet another high-risk area into your system: data-at-the-endpoints. This includes USB flash-disks, laptops, portable hard disks, CDs, and even smartphones.

The main challenge of data leak prevention

Having been made aware of the various aspects of data leakage, have you already come to grips with the extent of the task at hand?

There are two major things you need to do here to prevent data leakage.

One, you need to identify what data you have that can be considered as sensitive/confidential information. Of course you have financial information and employee salaries in your files. But do you also store personally identifiable information? Do you have trade secrets that are stored in electronic form?

Two, you need to pinpoint their locations. Are they only on your hard disks and laptops? Or have they made their way to flash drives, CDs/DVDs, or portable HDDs? Are they being transmitted through email or any other file transfer media?

The reason why you need to know what your sensitive data are as well as where they are is because you would like all efforts of securing them to be as efficient and unobtrusive as possible.

Let’s say, as a way of protecting your data, you decide to implement encryption. Since encryption can consume a lot of storage space and significantly reduce performance, it may be impractical to encrypt your entire database or all your files. For the same reason, you wouldn’t want to encrypt every single email that you send.

Thus, the best way would be to encrypt only the data that really need encryption. But again, you need to know what data needs to be encrypted and where those data can be found. That alone is no simple task.

Not only will you need to deal with the data you already have, you will also have to worry about the data that will go through your systems during the course of your day-to-day transactions.

Identifying sensitive data as it enters or leaves your system, goes through your network, or gets stored in your file system or database, and then applying the necessary security actions should be done automatically and intelligently. Otherwise, you could end up spending on a lot of man-hours or, worse, wasting them on a lot of false positives and negatives.

Contact Us

  • (+353)(0)1-443-3807 – IRL
  • (+44)(0)20-7193-9751 – UK
The Cloud: Changing the Game for Small Businesses

There is a consensus among cloud experts that the onset of cloud computing will benefit small organisations the most. In fact, many even go as far as saying that the cloud and small businesses are a match made in IT heaven. How much of this is true and how much of this is merely part and parcel of the hype surrounding cloud computing?

The Cloud as the Great?Equaliser

If you closely examine the essential characteristics of cloud computing, particularly public cloud services, you will see why small organisations would be very interested in the cloud, and would eventually flock to it, like moths to a flame. And why not? Cloud computing is turning out to be the weapon that can allow small and medium organisations to compete on a more level playing field against large enterprises.

Here are some cloud computing benefits that may just close the gap between the two.

  • Significantly lower IT spending. With little to no investment at all on hardware infrastructure and practically zero maintenance costs, SMBs that would have required substantial capital for IT are now finding it easy to get a business started from scratch or develop and test out new products by using the cloud as the backbone of their IT set-up. The pay-as-you-go pricing scheme that cloud computing offers allows companies to start small and scale up as needed, or when the revenue starts coming in.
  • Higher employee productivity. Licensing fees for software applications can run high even if you don’t have a large staff. Good thing there are now a host of cloud-based office tools – word processors, spreadsheets, presentations, accounting systems, etc. – that can boost employee productivity without the corresponding costs that small businesses can ill afford. Plus, team members in remote locations can continue to collaborate with the rest through any internet-connected device in real time.
  • Easier, better communication. The easy accessibility of communication apps has also changed the way employees interact with fellow employees and more importantly, with customers. Whether through email, instant messaging, or social networks, cloud services have given individuals and businesses more ways of giving and getting feedback. The best thing about it is that most of these services don’t cost much or are even free, giving SMBs ample tools to create better products and improve service.
  • A Look at the Figures Many small businesses are already seeing the potential in the cloud, with SaaS (Software as a Service) applications most commonly used among the early adopters. These services include email and other communication apps, file sharing, and backup.

In a February 2012 Edge Strategies survey (commissioned by Microsoft) of 3,000 small businesses in the US, the following data came to light:

  • The number of small companies with 2 to 10 employees using paid cloud services will triple in the next three years;
  • Current cloud users report purchasing an average of 4 services in the cloud now and expect to use 6 in the future;
  • Fifty percent agree that cloud computing is going to become more important for businesses such as theirs.

Further, a survey of 323 SMBs recently released by social business site Spiceworks and sponsored by EMC reveals that from 48 percent at the start of 2012 and 28 percent a year ago, 62 percent of the businesses surveyed now use some type of cloud app.

What these numbers show is that cloud adoption among small and medium enterprises is starting to gain ground and for sure, more will do the same as understanding and awareness increase. Yes, these businesses should still perform their due diligence as there is no one-size-fits-all cloud solution. But for those companies who have managed to find the right cloud apps and services for their needs, it’s all sunny skies up ahead.

Contact Us

  • (+353)(0)1-443-3807 – IRL
  • (+44)(0)20-7193-9751 – UK

Ready to work with Denizon?

Contact Us Today