How COBIT helps you achieve SOX Compliance

First released way back in 1996, COBIT has already been around for quite a while. One reason why it never took off was because companies were never compelled to use it ? until now. Today, many CEOs and CIOs are finding it to be a vital tool for achieving SOX compliance in IT.

Thanks to SOX, COBIT (Control Objectives for Information and related Technology) is now one of the most widely accepted source of guidance among companies who have IT integrated with their accounting/financial systems. It has also gained general acceptability with third parties and regulators. But how did this happen?

Role of control frameworks in SOX compliance

You see, the Sarbanes-Oxley Act, despite having clearly manifested the urgency of establishing effective internal controls, does not provide a road map for you to follow nor does it specify a yardstick to help you determine whether an acceptable mileage in the right direction has already been achieved.

In other words, if you were a CIO and you wanted to find guidance on what steps you had to take to achieve compliance, you wouldn’t be able to find the answers in the legislation itself.

That can be a big problem. Two of your main SOX compliance obligations as a CEO or CIO is to assume responsibility in establishing internal controls over financial reporting and to certify their effectiveness. After that, the external auditors are supposed to attest to your assertions. Obviously, there has to be a well-defined basis before you can make such assertions and auditors can attest to anything.

In the language of auditors, this ?well-defined basis? is known as a control framework. Simply put, once you certify the presence of adequate internal controls in your organisation, the external auditor will ask, ?What control framework did you use??

Knowing what control framework you employed will help external auditors determine how to proceed with their evaluations and tests. For your part, a control framework can serve as a guide to help you work towards specific objectives for achieving compliance. Both of you can use it as a common reference point before drawing any conclusions regarding your controls.

But there are many control frameworks out there. What should you use?

How SOX, COSO, and COBIT fit together

Fortunately, despite SOX?s silence regarding control frameworks, you aren’t left entirely to your own devices. You could actually take a hint from the SEC and PCAOB, two of the lead organisations responsible for implementing SOX. SEC and PCAOB point to the adoption of any widely accepted control framework.

In this regard, they both highly endorse COSO, a well-established internal control framework formulated by the Committee of Sponsoring Organisations of the Treadway Commission (COSO). Now, I must tell you, if you’re looking specifically for instructions pertaining to IT controls, you won’t find those in COSO either.

Although COSO is the most established control framework for enterprise governance and risk management you’ll ever find (and in fact, it’s what we recommend for your general accounting processes), it lacks many IT-related details. What is therefore needed for your IT processes is a framework that, in addition to being highly aligned with COSO, also provides more detailed considerations for IT.

This is where COBIT fits the bill.

How COBIT can contribute to your regulatory compliance endeavors

COBIT builds upon and adheres with COSO while providing a finer grain of detail focused on IT. You can even find a mapping between COBIT IT processes and COSO components within the COBIT document itself.

Designed with regulatory compliance in mind, COBIT lays down a clear path for developing policies and good practice for IT control, thus enabling you to bridge the gap between control requirements, technical issues, and business risks.

Some of the components you’ll find in COBIT include:

IT control objectives

These are statements defining specific desired results that, as a whole, characterise a well-managed IT process. They come in two forms for each COBIT-defined IT process: a high-level control objective and a number of detailed control objectives. These objectives will enable you to have a sense of direction by telling you exactly what you need to aim for.

Maturity models

These are used as benchmarks that give you a relative measurement stating where your level of management or control over an IT process or high-level control objective stands. It serves as a basis for setting as-is and to-be positions and enables support for gap analysis, which determines what needs to be done to achieve a chosen level. Basically, if a control objective points you to a direction, then its corresponding maturity model tells you how far in that direction you’ve gone.

RACI charts

These charts tell you who (e.g. CEO, CFO, Head of Operations, Head of IT Administration) should be Responsible, Accountable, Consulted, and Informed for each activity.

Goals and Metrics

These are sets of goals along with the corresponding metrics that allow you to measure against those goals. Goals and metrics are defined in three levels: IT goals and metrics, which define what business expects from IT; process goals and metrics, which define what the IT process should deliver to support It’s objectives; and activity goals and metrics, which measure how well the process is performing.

In addition to those, you’ll also find mappings of each process to the information criteria involved, IT resources that need to be leveraged, and the governance focus areas that are affected.

Everything is presented in a logical and manageable structure, so that you can easily draw connections between IT processes and business goals, which will in turn help you decide what appropriate governance and control is needed. Ultimately, COBIT can equip you with the right tools to maintain a cost-benefit balance as you work towards achieving SOX compliance.

Check our similar posts

2015 ESOS Guidelines Chapter 7, 8 & 9 – Sign-Off, Compliance & Appeals

This is the final chapter in our series of short posts summarising the quite complex ESOS guidelines (click on ?Comply with ESOS? to see the details). This one addresses the legalities to follow to complete your report – and how to appeal if you are not happy with any of the Environment Agency?s decisions.

Director Sign-Off

This is by no means an easy ride. Confirmation of the work at individual or lead assessor level locks the company into the penalty cycle in the event there are significant irregularities. By signing off the assessment, the board level director(s)^# agree that they have

Reviewed the enterprise?s ESOS recommendations
Believe the enterprise is within the scope of the scheme
Believe the enterprise is compliant with the scheme
Believe the information provided is correct

Having an internal assessor requires a second board-level signature.

Compliance

You report compliance on the internet. This is free and you can do it at any time within the deadline. You can dip in and out of the process as many times as you wish, but must use the link in the receipting email. While this is something a board member must do, there is no reason why the lead assessor should not complete the basics. The online compliance notification addresses the following topics:

The ESOS contact person in the enterprise
Any aggregation / dis-aggregation during the period
The names and contact details of the lead assessor
The proportion of energy consumption per compliance route

The Environment Agency will acknowledge receipt. This does not constitute acceptance. You should keep the ESOS evidence pack in a safe place with at least one backup elsewhere.

Compliance & Enforcement Issues

In the event the Environment Agency decides your enterprise has not met ESOS requirements, it may either (a) issue a compliance notice with instructions, or (b) apply one of the following civil penalties:

A fine of up to ?5,000 for failure to maintain records
A fine of up to ?50,000 for failure to undertake an energy audit
A fine of up to ?50,000 for a false or misleading statement

Any enterprise has the right of appeal against government decisions. In the case of ESOS, this is via:

The First-Tier Tribunal if your enterprise is England, Wales or off-shore based
The Scottish Minister if your enterprise is based in Scotland
The Planning Commission if your enterprise is Northern Ireland-based

The notice you appeal against will supply details of the appeal steps to take.

This blog and its companion chapters concerning the ESOS Guidelines as amended 2015 are with compliments of ecoVaro. We are the people who break ESOS data into manageable chunks of information, so that board-level directors have greater confidence in what they sign.

Excel Spreadsheet Conversion to SQL Reports

Spreadsheets are flexible, inexpensive and easy to use. They are especially handy when it comes to beating report submission deadlines or making impromptu data computations.

Unfortunately, organisations heavy reliance on spreadsheets have made these User Developed Applications (UDA) into high-risk office tools. Simple spreadsheet errors like leaving out a negative sign or a cut-and-paste mistake have already caused million-dollar discrepancies. Also, when a fraudulent employee enters into the picture, the risks become unimaginable.
Think TransAlta’s spreadsheet cut-and-paste glitch (the company later called this a ‘simple clerical error’) which caused the energy firm a whopping $24 million loss or Fidelity’s overstatement of its earnings owing to the omission of the minus sign on the spreadsheet of a $1.3 billion net capital loss.

Denizon can convert your Excel Spreadsheets to a web based SQL Server Reporting Services (SSRS). It does not import Excel data, rather it allows the creation and deployment of reports in a more efficient manner by querying the data.

So what is the problem with Spreadsheets?

Plagued with risk issues and vulnerable to fraud
Lacking in control features especially when copied, edited and emailed between many users
A burden to regulation compliance e.g. SOX (Sarbanes-Oxley)

Moreover:

Accidental copy-paste/Omission of a negative sign/Erroneous range selection
Incorrect data input or unintentional deletion of a character, cell, range, column, or row
Possibility of the user working on the wrong version
Prone to inconsistent company-wide reporting
Often ‘defenceless’ against unauthorised access

See Top 10 Disadvantages of Spreadsheets

What makes SQL Server Reporting Services better than Spreadsheets?

Free from spreadsheet risks & equipped with built-in controls that substantially reduce risks to data
Less prone to fraud
More suitable for regulatory compliance e.g. SOX
Designed for an agile business environment

Automatic consolidation eliminates errors and wasted time caused by tedious copy-pasting of data and linking of cells
Better collaboration capabilities allows team members to bring their heads together for planning, budgeting, and reporting even while on the go
Mobility support enables users to input data or retrieve information through their wireless mobile device

Superior sharing features ensures that everyone is exactly on the same page and viewing real-time information
Dashboards provide insightful information at-a-glance through KPIs, graphs, and various metrics
Drill-downs enable users to investigate unusual figures and gain a better understanding of the details that contribute to the big picture
Easy to learn interfaces allow your organisation to cope with fast personnel turnaround or Mergers & Acquisitions

Don’t know how to shift from Spreadsheets to SQL Server Reporting Services?

We’ve got the knowledge and expertise to assist you in:

Making a smooth and cost-efficient transition from risky spreadsheets to reliable reports
Designing and implementing SOX-compliant report-generating methods and procedures
Putting exposure to high-risk reporting methods a thing of the past

What is Servitisation?

In the current generation, innovation has transformed industries, businesses, economies, and livelihoods. Those who’ve accepted to embrace the changes have prospered and remained afloat and relevant in their respective industries.?

However, failure to embrace change has seen companies like Blockbuster pushed out of business by more innovative and technology-oriented companies like Netflix.?

What does this tell you?

That the only way to stay in business, despite the many challenges your business could be facing, is to remain alert to the dynamic demands of customers, many of which are dictated by technological advancements.?

So, if you’re a manufacturer and you’re keen on diving deeper into technology to stay on top of the game and beat your competition, you must also be expectant of the fast-approaching servitisation-centred economy. Companies like Rolls Royce that have already embraced servitisation are making great gains in their areas of expertise.?

What is Servitisation?

Servitisation can be defined as the transformation of a manufacturing firm from the mere offering of products to the market to providing innovative and invaluable services alongside their products. By so doing, the sale becomes an ongoing engagement and not a one-off event. Cranfield University professors call it “the innovation of an organisation’s capabilities and processes to better create mutual value through a shift from selling a product to selling product-service systems.”?

As foreign as it may seem for some professionals, servitisation has been a need that, though not embraced, its demand remains evident. Nonetheless, firms have hesitated to implement it. Shifting from manufacturing products only to incorporating product-centric services alongside the products is not a walk in the park. It boils down to completely changing the company’s entire structure and processes.

All the same, change is never comfortable, and that’s why it’s always best to focus on the positive for motivation.

Servitisation Case Study

Some manufacturing firms have already embraced servitisation, and they’re reaping big from it. They’ve understood the benefits of offering more value to customers at less cost. What Rolls Royce is doing currently with its “power-by-the-hour” program is a good example of servitisation.

Instead of selling Aero Engines and letting customers take charge of maintenance and uptime, Rolls-Royce now offers a full package that includes a product and relevant services.?

Essentially, what the company is creating is an intimate and long-term relationship with its customers.

The total care package by Rolls Royce means it’s essentially renting out its engines to customers and monitoring data for potential maintenance needs. The plan guarantees that maintenance is only done when necessary and avoidable damage detected in good time. As a result, there is a clear reduction in the overall cost.

Initially, Rolls Royce would make money by basically selling and repairing engines. That meant that the worse the engines, the more repairs required and the more the money the company would make.?

However, things changed when the company realised there is no demand for a product that’s constantly in the repair shop. That prompted Rolls Royce to embrace servitisation.

Servitisation aligns the interests of the customer and those of the manufacturer to ensure everyone benefits. Rolls Royce has been offering this package to airlines since 2010, and the company has seen significant returns as a result.

Benefits

There are several benefits of incorporating servitisation into your manufacturing firm. Below are three of the strongest benefits

Financial Stability– Servitisation establishes a more secure revenue stream because of the long term connection between manufacturer and customer. This also translates to loyal customers, meaning more profit.
Strong Customer Retention Rate– Being more experienced about the equipment and the constant tracking and monitoring that comes with servitisation; manufacturers are realising that they can keep more customers.
Selling a Solution And a Product– Today customers are not just looking to buy a product, instead, they want both the product and the solution to their problem. Meaning you make more money for the product you manufacture and the service you offer to your customers.

Implementation of Servitisation in the Industry

To effectively implement servitisation, there must be an effective two-way flow of information and data in the supply chain. Meaning you may require software like FieldElite for scalable condition monitoring of performance. With FieldElite, for example, servitisation is made easier for you because it enables you to monitor the performance of your assets remotely.

Maintenance and monitoring of assets were traditionally very expensive and time-consuming until the arrival of intelligent software that makes work easier and cost-effective for manufacturers. FieldElite uses advanced learning algorithms to remotely automate the entire process, allowing you to detect, in real-time, the performance and need for maintenance on your asset.

Required Organisational Changes

A few important steps include;

Companies that invest in continuous training and development always have a more competitive edge than their counterparts. Meaning an important step towards servitisation is training the workforce. This is important, considering that the company structure, focus, and process will have to change.

Set up a team that is focused on the challenge, change, and creation. With this, you can easily adjust to industry changes. The team should always work on knowing what should be adjusted and when it should be.?

In the shift to servitisation, adopting a comprehensive service technology is an important step. Such service technology software includes FieldElite. This technology will ensure that you’re able to monitor your product in real-time, meaning you can maintain good performance for as long as possible.

Because servitisation essentially focuses on the customer, take time to study customer behaviour. Knowing what your customers need and want will help you remain relevant in the industry.

Conclusion

As the demand for more benefits and long-lasting relationships with dealers grow, so is the need for manufacturers to adjust. Hence more and more manufacturing companies are leaning towards embracing servitisation as a solution to the growing demand.?

In turn, manufacturers who’re attaching service contracts to their product sales are making more than those who remain stuck in the traditional approach to sales.?

Essentially, servitisation will ensure that, as a manufacturer, you remain relevant to your customers now and in years to come. This is a much better arrangement in terms of saving costs and making more returns. Remember to be successful, you have to be flexible enough to change with demand.