How To Get Started with your IT Compliance Efforts for SOX

There’s no question about it. For many of you top executives in the corporate world, all roads leading to a brighter future have to go through SOX compliance. And because the business processes that contribute to financial reporting (the crux of the Sarbanes-Oxley Act) are now highly reliant on IT systems, it is important to focus a good part of your attention there.

It is a long and arduous path to IT compliance, so if you don’t want your company to fall by the wayside due to inefficient utilisation of resources, it is important to set out with a plan on hand. What we have here are some vital information that will guide you in putting together a sound plan for SOX compliance of your company?s IT systems.

Why focus on IT systems for SOX compliance?

We’ll get to that. But first, let’s take up the specific portions of the Sarbanes-Oxley Act that affect information technology. These portions can be found in Section 302 and Section 404 of the act.

In simplified form, Section 302 grants the SEC (Securities and Exchange Commission) authority to come up with rules requiring you, CEOs and CFOs, to certify in each annual or quarterly financial report the following:

  • that you have reviewed the report;
  • that based on your knowledge, the report does not contain anything or leave out anything that would render it misleading;
  • that based on your knowledge, all financial information in the report fairly represent the financial conditions of the company;
  • that you are responsible for establishing internal controls over financial reporting; and
  • that you have assessed the effectiveness of the internal controls.

Similarly, Section 404, stated in simplified form, allows the SEC to come up with rules requiring you, CEOs and CFOs, to add an internal control report to each annual financial report stating that you are responsible for establishing internal controls over financial reporting.

You are also required to assess the effectiveness of those controls and to have a public accounting firm to attest to your assessment based upon standards adopted by the Public Company Accounting Oversight Board (PCAOB).

While there is no mention of IT systems, IT systems now play a significant role in financial reporting. Practically all of the data you need for your financial reports are stored, retrieved and processed on IT systems, so you really have to include them in your SOX compliance initiatives and establish controls on them.

Now that that’s settled, your next question could very well be: How do you know what controls to install and whether those controls are already sufficient to achieve compliance?

Finding a suitable guide for IT compliance

The two bodies responsible for setting rules and standards dealing with SOX, SEC and PCAOB, point to a well-established control framework for guidance – COSO. This framework was drafted by the Committee of Sponsoring Organisations of the Treadway Commission (COSO) and is the most widely accepted control framework in the business world.

However, while COSO is a tested and proven framework, it is more suitable for general controls. What we recommend is a widely-used control framework that aligns well with COSO but also caters to the more technical features and issues that come with IT systems.

Taking into consideration those qualifiers, we recommend COBIT. COBIT features a well thought out collection of IT-related control objectives grouped into four domains: Plan and Organise (PO), Acquire and Implement (AI), Deliver and Support (DS), and Monitor and Evaluate (ME). The document also includes maturity models, performance goals and metrics, and activity goals.

A few examples of COBIt’s detailed control objectives are:

DS4.2 – IT Continuity Plans
DS4.9 – Offsite Backup Storage
DS5.4 – User Account Management
DS5.8 – Cryptographic Key Management
DS5.10 – Network Security
DS5.11 – Exchange of Sensitive Data

By those titles alone, you can see that the framework is specifically designed for IT. But the document is quite extensive and, chances are, you won’t need all of the items detailed there. Furthermore, don’t expect COBIT to specify a control solution controls for every control objective. For example, throughout the control objective DS4 (Ensure Continuous Service), you won’t find any mention of virtualisation, which is common in any modern business continuity solution.

Basically, COBIT will tell you what you need to attain in order to achieve effective governance, management and control, but you’ll have to pick the solution best suited to reach that level of attainment.

Articles highly relevant to the one you just read:

Month End Accounting The Way It Should Be Today
Spreadsheet Woes ? Burden in SOX Compliance and Other Regulations
Spreadsheet Woes ? Limited Features For Easy Adoption of a Control Framework
How Internal Auditors Can Win The War Against Spreadsheet Fraud

Check our similar posts

Benefits Realisation Frameworks – A Useful Handle

One of the greatest challenges of project management is maintaining top-down support in the face of fluctuating priorities. If you elect to take on the role yourself and are peppered by other priorities, it can be a challenge to exactly remember why you are changing things and what your goals are. Sometimes you may not even notice you have reached your goal.

The Benefits Realisation Chart-room

The Benefits Realisation Model is a framework on which to hang key elements of any project. These traditionally include the following, although yours may not necessarily be the same:

  • Definition of the project goal
  • Quantification of intended benefits
  • Project plan versus actual progress
  • How you know you reached your goal
  • Quantification of actual benefits

Another way of describing Benefits Realisation Frameworks is they answer four fundamental questions that every project manager should know by heart:

  • What am I going to do?
  • How am I going to do it?
  • When will I know it’s done?
  • What exactly did I achieve?

The Benefits Realisation Promise

An astounding number of projects fail to reach completion, or miss their targets. It’s not for nothing that the expression ?after the project failed the non-participants were awarded medals? is often used in project rooms. We’re not saying that it is a panacea for success. However it can alert you to warnings that your project is beginning to falter in terms of delivering the over-arching benefits that justify the effort.

When Projects Wander Off-Target

Pinning blame on participants is pointless when project goals are flawed. For example, the goals may be entirely savings-focused and not follow through on what to do with the windfall. At other times realisation targets may be in place, but nobody appointed to recycle the benefits back into the organisation. This is why a Benefits Realisation Framework needs to look beyond the project manager?s role.

Realisation Management in Practice

If the project framework does not look beyond the project manager?s role, then it is over when it reaches its own targets ? and can even run the risk of being an event that feeds entirely off itself. In order to avoid a project being a means to its own end, this first phase must culminate with handover to a benefits realisation custodian.

An example of this might be a project to centralise facilities that is justified in terms of labour savings. The project manager?s job is to build the structure. Someone else needs to rationalise the organisation.

In conclusion, the Benefits Realisation Framework is a useful way of ensuring a project does not only achieve its internal goals, but also remains a focus of management attention because of its extended, tangible benefits.

Spreadsheet Woes – Ill-Equipped for an Agile Business Environment

These days, crucial business decisions have to be made in a split second. However, the quality of these decisions hinges quite often on timely, insightful information and relevant business reporting.

How effective is your business reporting solution in providing you with the information you need at the time you need it?

Chances are, like 75% of small and medium businesses, your company is using spreadsheets. True, spreadsheets are the most common go-to solutions for on-the-fly forecasting, but they may not be your best option for presenting information that require consolidation and in-depth analysis and involve a lot of number crunching, especially with critical data at stake.

Furthermore, spreadsheet-based reports are rarely produced in a timely manner. In today?s fast evolving business environment where flexibility, mobility, and timeliness are the order of the day, this simply won’t do.

Let’s take a look at the particular areas where spreadsheets fall short when it comes to providing dynamic and sound financial reports:

Collaboration

With rapidly changing market conditions, organisations have to conduct budgeting, forecasting, and planning more often. Hectic schedules and geographical distances aren’t a hindrance though, because technologies like the Internet, advanced telecommunications and mobile devices can put instantaneous collaboration at everyone?s fingertips.

But collaborative activities in a dynamic setting can only succeed if all participating individuals are given secure, real time and simultaneous access to the same relevant information. This way, every change made is automatically consolidated and projected unto the bigger picture for everyone to digest.

Alas, spreadsheets aren’t built for this.

Cost Efficiency

Whether we’re in a recession or not, cost efficiency has to be taken into consideration. Are spreadsheets really the cost-effective solution?

Think ?time is money?. With the length of time needed to prepare data, establish controls, consolidate reports and distribute copies, you’ll realise how expensive spreadsheets actually are.

The ability to innovate in a changing economic environment and limited resources – a valuable derivative of agile practices – can give your company a very significant advantage. But dedicating so much time on spreadsheet management can strip your organisation of room for innovation.

Quality of Reports

Business empires rise and fall on the power of relevant information. At the end of the day, top management should assess their sources of key performance reports, planning tools and budgeting applications using these parameters:

  • Does your financial reporting system give you the right information right when you need it?
  • Do the reports allow you to look beyond the numbers to spot trends or forecast changes in the market?
  • Do they furnish enough significant data for you to make informed decisions in good time?

Spreadsheets weren’t designed to analyse data on the enterprise level. As a result, spreadsheet reports often take far too long to prepare and more importantly, may lack the dimension and depth that are crucial in decision making.

Data Reliability

We’re all familiar with the risks associated with spreadsheets. This error-prone UDA can provide inaccurate information simply because of a broken link, an incomplete range, a deleted number, or an incorrect formula. In an active business scenario where data manipulation has to be done under constant time pressure, the risk probabilities escalate.

As they always say, ?If anything can go wrong, it will?. With spreadsheets, a lot of things could go wrong. Is this the kind of tool you?d like to work with when making fast, crucial decisions? If you’re still using spreadsheets, then you?d best forget about dynamic reports and rolling forecasts.

Inability to adapt to personnel turnover

A key challenge in maintaining the spreadsheet system is picking up where another left off. A user would find it difficult to debug, revise, or analyse a spreadsheet system he developed himself and the process becomes doubly complicated if or when another person takes over.

Starting from scratch is painfully counterproductive, so that a newcomer has to spend hours figuring out the original entries in the spreadsheet and the reports it yields.

While no one is indispensable in any organisation, it’s pretty much accurate to say that if a spreadsheet ?developer? leaves, it could momentarily halt the production of key finance reports. In a fast changing business landscape, such failure to monitor performance at critical times could sound the death knell for your company.

More Spreadsheet Blogs


Spreadsheet Risks in Banks


Top 10 Disadvantages of Spreadsheets


Disadvantages of Spreadsheets – obstacles to compliance in the Healthcare Industry


How Internal Auditors can win the War against Spreadsheet Fraud


Spreadsheet Reporting – No Room in your company in an age of Business Intelligence


Still looking for a Way to Consolidate Excel Spreadsheets?


Disadvantages of Spreadsheets


Spreadsheet woes – ill equipped for an Agile Business Environment


Spreadsheet Fraud


Spreadsheet Woes – Limited features for easy adoption of a control framework


Spreadsheet woes – Burden in SOX Compliance and other Regulations


Spreadsheet Risk Issues


Server Application Solutions – Don’t let Spreadsheets hold your Business back


Why Spreadsheets can send the pillars of Solvency II crashing down

?

Advert-Book-UK

amazon.co.uk

?

Advert-Book-USA

amazon.com

Contact Us

  • (+353)(0)1-443-3807 – IRL
  • (+44)(0)20-7193-9751 – UK
Business Turnaround Tip for a Successful MBO Turned Awry

When you acquire a company through an MBO, your hopes are always high. You know the business more than anyone else and you’ve got too much at stake to do a sloppy job. So how could things go wrong? Well sometimes they do. And if you don’t make a quick business turnaround, you could end up losing more than just your company.

If that management buyout was financed by a bank, then chances are you were required to invest a sizeable amount from your own pockets. I won’t be surprised if you even remortgaged your house for it.

Regardless of your source of funding, whether it was a bank, a venture capitalist or through a deferred consideration, the mere thought of losing your job and getting buried in enormous debt at the same time might be too much to bear. If you get too overwhelmed by your emotions and can’t think clearly, you’ll have to step out of the driver?s seat and have someone take over.

That someone can’t be a member of the management team that took part in the management buyout. Like you, he/she might be in panic mode as well. You need someone from the outside who has no emotional attachments to the company and hence can view the crisis from a clear perspective.

Here’s what’s needed:

Review and Plan

Take a closer look at all factors affecting your business: governance and organisational structures, employees, suppliers, systems and procedures, roles and responsibilities, etc. Identify potential risks and assess the likelihood of them affecting your business.

This will give a clearer picture of cause-and-effect relationships as well as the specific tasks on hand.

Thus, when it is time to draft a plan, you can do so from a well-informed standpoint. This will enable you to target specific areas of improvement and avoid pointless activities.

Assure all stakeholders

Once a watertight plan has been formulated, you will have to approach your stakeholders. They?ll need to know what your directions are. Once they’re all sold on the plan, you could implement our strategies unimpeded.

This is a very crucial part because a sceptical stakeholder can serve as a major stumbling block in our efforts to improve the situation. You need to convince your banks, sponsors, and investors in order to avoid additional financial obstacles. You need to convince your suppliers too. If they cut off or limit supply, you won’t be able to continue doing business.

Most of all, you need to persuade your staff and employees that the proposed major changes have to be carried out in order for the company to survive. You can’t run your operations without them on board.

Redesign and set up new systems and procedures

Any company requiring a turnaround will certainly have systems and procedures that are no longer working well in the current conditions and hence would require either major changes in key areas or a total revamp. You need to study personnel roles and responsibilities as well as systems and processes, including financial and IT systems, and supervise the implementation of necessary changes.

You will need to evaluate your existing IT architecture and determine how you can best maximise what you already have and propose what you think will work more efficiently for our proposed systems and procedures. Every piece of hardware or software recommended will take into consideration your present resources. There are many solutions out there, you just need to find the best fit.

Contact Us

  • (+353)(0)1-443-3807 – IRL
  • (+44)(0)20-7193-9751 – UK

Ready to work with Denizon?

Contact Us Today