How To Get Started with your IT Compliance Efforts for SOX

There’s no question about it. For many of you top executives in the corporate world, all roads leading to a brighter future have to go through SOX compliance. And because the business processes that contribute to financial reporting (the crux of the Sarbanes-Oxley Act) are now highly reliant on IT systems, it is important to focus a good part of your attention there.

It is a long and arduous path to IT compliance, so if you don’t want your company to fall by the wayside due to inefficient utilisation of resources, it is important to set out with a plan on hand. What we have here are some vital information that will guide you in putting together a sound plan for SOX compliance of your company?s IT systems.

Why focus on IT systems for SOX compliance?

We’ll get to that. But first, let’s take up the specific portions of the Sarbanes-Oxley Act that affect information technology. These portions can be found in Section 302 and Section 404 of the act.

In simplified form, Section 302 grants the SEC (Securities and Exchange Commission) authority to come up with rules requiring you, CEOs and CFOs, to certify in each annual or quarterly financial report the following:

that you have reviewed the report;
that based on your knowledge, the report does not contain anything or leave out anything that would render it misleading;
that based on your knowledge, all financial information in the report fairly represent the financial conditions of the company;
that you are responsible for establishing internal controls over financial reporting; and
that you have assessed the effectiveness of the internal controls.

Similarly, Section 404, stated in simplified form, allows the SEC to come up with rules requiring you, CEOs and CFOs, to add an internal control report to each annual financial report stating that you are responsible for establishing internal controls over financial reporting.

You are also required to assess the effectiveness of those controls and to have a public accounting firm to attest to your assessment based upon standards adopted by the Public Company Accounting Oversight Board (PCAOB).

While there is no mention of IT systems, IT systems now play a significant role in financial reporting. Practically all of the data you need for your financial reports are stored, retrieved and processed on IT systems, so you really have to include them in your SOX compliance initiatives and establish controls on them.

Now that that’s settled, your next question could very well be: How do you know what controls to install and whether those controls are already sufficient to achieve compliance?

Finding a suitable guide for IT compliance

The two bodies responsible for setting rules and standards dealing with SOX, SEC and PCAOB, point to a well-established control framework for guidance – COSO. This framework was drafted by the Committee of Sponsoring Organisations of the Treadway Commission (COSO) and is the most widely accepted control framework in the business world.

However, while COSO is a tested and proven framework, it is more suitable for general controls. What we recommend is a widely-used control framework that aligns well with COSO but also caters to the more technical features and issues that come with IT systems.

Taking into consideration those qualifiers, we recommend COBIT. COBIT features a well thought out collection of IT-related control objectives grouped into four domains: Plan and Organise (PO), Acquire and Implement (AI), Deliver and Support (DS), and Monitor and Evaluate (ME). The document also includes maturity models, performance goals and metrics, and activity goals.

A few examples of COBIt’s detailed control objectives are:

DS4.2 – IT Continuity Plans
DS4.9 – Offsite Backup Storage
DS5.4 – User Account Management
DS5.8 – Cryptographic Key Management
DS5.10 – Network Security
DS5.11 – Exchange of Sensitive Data

By those titles alone, you can see that the framework is specifically designed for IT. But the document is quite extensive and, chances are, you won’t need all of the items detailed there. Furthermore, don’t expect COBIT to specify a control solution controls for every control objective. For example, throughout the control objective DS4 (Ensure Continuous Service), you won’t find any mention of virtualisation, which is common in any modern business continuity solution.

Basically, COBIT will tell you what you need to attain in order to achieve effective governance, management and control, but you’ll have to pick the solution best suited to reach that level of attainment.

Articles highly relevant to the one you just read:

Month End Accounting The Way It Should Be Today
Spreadsheet Woes ? Burden in SOX Compliance and Other Regulations
Spreadsheet Woes ? Limited Features For Easy Adoption of a Control Framework
How Internal Auditors Can Win The War Against Spreadsheet Fraud

Check our similar posts

The Types of Industries That Can Benefit from Field Service Software

Initially, field service software was designed with field techs and their managers in mind. However, in the recent past, other industries have taken this path to better the performance of their businesses. Any industry that deploys skilled laborers and assets to off-site locations benefits from field service software. It’s all about resource allocation and data centralization for efficient management and running of the business? activities. With field service software, you got all your business? functions logged in one place.

So, who needs field service management software? Professionals like electricians, plumbers, IT technicians, construction workers, and carpenters all find it useful. Moreover, there?s a wide range of application in many different types of industries.

Here are some industries that benefit from field service management software.

Fire and Life Safety

In a fire and life safety industry, equipment and safety systems should be kept running at peak efficiency. Therefore, it’s necessary to provide appropriate services that will ensure the smooth running of processes. On top of complying with government codes, fire and security systems installed should offer reliable services. Since service is at the core of this industry?s operation, most people in fire and security industries are turning to field service software to automate operations of their service delivery. With the field service software tools, the industry can easily monitor security technologies, quickly respond to customers, and manage compliance, inspections, and procedures effectively.

Medical Device Enterprises

For medical device companies seeking to improve their services, sales, and compliance, field service software becomes very essential for the smooth running and operations of their functions. The medical device enterprises that greatly benefit from this software include those offering installations, repair, and maintenance of medical equipment. With the comprehensive field service tools, service delivery and performance is greatly improved.

Moreover, with the field service software, these industries find better ways of tracking critical records needed for regulatory compliance since the medical industry is one of the most regulated industries in the globe. For the companies doing the manufacturing of medical equipment, they can integrate field service software in their accounting systems to streamline their invoice processes and shorten their billing cycles.

IT and Communications Services Companies

With the remarkable technological advancements in the recent past, Internet service providers, cable companies, and communications organizations are looking for better ways of service delivery to keep up with the pace of the growing technology. Connections are becoming more complex day by day propelled by an explosion in new data sources, and the use of the devices. To keep up with the increased demand for instant services by customers, the IT and communication service companies, are turning to field service software to make their service delivery more effective.

A combination of the robust, advanced scheduling system and rich functionality makes this software very useful to the communication service companies. They can use the software to design and install complex internet infrastructure. Moreover, field service software can be used by these companies to set up recurring maintenance plans to maintain the installed internet systems.

Oil and Gas Enterprises

Most oil and gas industries are faced by complexities which need special handling for better business performance. Since the running of projects is at the cornerstone of their businesses, they’re always looking for better ways to ensure a smooth running of their project activities. For this reason, most of the oil and gas enterprises that have discovered the benefits of field service software are integrating the main activities of their projects in this software.

With the project-based software tools, there?s an efficient flow of information and transparency throughout the enterprise ensuring excellent project management. With the checklist feature included in most field service software, inspections, compliance, site surveys, and maintenance of procedures is made easier in oil and gas companies.

Facilities Management Industry

Given that this is a service industry, high-level of efficiency is paramount. To meet customer expectations and battle against cost, most facility management industries are turning to field service software. With the comprehensive tools included in the field service software, supervisors can assign tasks to their reports, monitor their progress, and receive alerts on critical issues while in a remote place or at the comfort of their office.

Maintenance and emergency repairs in the facility management industry are greatly supported by this software ensuring increased productivity and efficiency. Additionally, with field service software the industries benefit from a streamlined workflow and improved communication that greatly reduces administration time and cost.

Industrial Equipment Enterprises

Industrial equipment companies aim at maximizing their overall productivity and preventing equipment downtime. There?s a wide range of activities that take place in industrial equipment companies which require field service software for higher levels of efficiency.

From load testing, installation projects, and load testing to emergency repairs, this software, enables the managers to design work orders, and get them ready for scheduling, and distribute them in a moment. With the equipment and asset tracking software, the supervisors can gain instant visibility into the equipment and assets in the field to ensure their regular maintenance. The scheduling and resourcing tools ensure the supervisors are in full control over the dispatching of their workforce, their schedules, and the route taken by each for maximum work output. Additionally, with the field service software, industrial equipment companies can meet their customer expectations.

Construction Industry

Since construction work involve both site work and office work, building industries find field service software very useful in integrating their field and office activities. Field service software is designed to establish effective communication between the office staff and the field operators. With inclusive software tools, the supervisors can easily manage daily inspections and receive feedback from the field workers without leaving the office. Moreover, documentation is simplified, and everything is documented in a central place so that it’s easier to retrieve important information at any time. With field service software, building industries can manage their construction efficiently while minimizing cost, and saving on time.

Filed service software is gaining popularity in the industrial world as most enterprises seek to improve their business? performance, and keep up with the competition. Moreover, more companies are expected to come on board as the field service software companies work extra hard to add more tools to suit a wide range of functions.

Finding the Best Structure for Your Enterprise Development Team

An enterprise development team is a small group of dedicated specialists. They may focus on a new business project such as an IoT solution. Members of microteams cooperate with ideas while functioning semi-independently. These self-managing specialists are scarce in the job market. Thus, they are a relatively expensive resource and we must optimise their role.

Organisation?Size and Enterprise Development Team Structure

Organisation structure depends on the size of the business and the industry in which it functions. An enterprise development team for a micro business may be a few freelancers burning candles at both ends. While a large corporate may have a herd of full-timers with their own building. Most IoT solutions are born out of the efforts of microteams.

In this regard, Bill Gates and Mark Zuckerberg blazed the trail with Microsoft and Facebook. They were both college students at the time, and both abandoned their business studies to follow their dreams. There is a strong case for liberating developers from top-down structures, and keeping management and initiative at arm?s length.

The Case for Separating Microteams from the?Organisation

Microsoft Corporation went on to become a massive corporate, with 114,000 employees, and its founder Bill Gates arguably one of the richest people in the world. Yet even it admits there are limitations to size. In Chapter 2 of its Visual Studio 6.0 program it says,

‘today’s component-based enterprise applications are different from traditional business applications in many ways. To build them successfully, you need not only new programming tools and architectures, but also new development and project management strategies.?

Microsoft goes on to confirm that traditional, top-down structures are inappropriate for component-based systems such as IoT solutions. We have moved on from ?monolithic, self-contained, standalone systems,? it says, ?where these worked relatively well.?

Microsoft’s model for enterprise development teams envisages individual members dedicated to one or more specific roles as follows:

Product Manager ? owns the vision statement and communicates progress
Program Manager ? owns the application specification and coordinates
Developer ? delivers a functional, fully-complying solution to specification
Quality Assurer ? verifies that the design complies with the specification
User Educator ? develops and publishes online and printed documentation
Logistics Planner ? ensures smooth rollout and deployment of the solution

Three Broad Structures for Microteams working on IoT Solutions

The organisation structure of an enterprise development team should also mirror the size of the business, and the industry in which it functions. While a large one may manage small microteams of employee specialists successfully, it will have to ring-fence them to preserve them from bureaucratic influence. A medium-size organisation may call in a ?big six? consultancy on a project basis. However, an independently sourced micro-team is the solution for a small business with say up to 100 employees.

The Case for Freelancing Individuals versus Functional Microteams

While it may be doable to source a virtual enterprise development team on a contracting portal, a fair amount of management input may be necessary before they weld into a well-oiled team. Remember, members of a micro-team must cooperate with ideas while functioning semi-independently. The spirit of cooperation takes time to incubate, and then grow.

This is the argument, briefly, for outsourcing your IoT project, and bringing in a professional, fully integrated micro-team to do the job quickly, and effectively. We can lay on whatever combination you require of project managers, program managers, developers, quality assurers, user educators, and logistic planners. We will manage the micro-team, the process, and the success of the project on your behalf while you get on running your business, which is what you do best.

Contact Us

(+353)(0)1-443-3807 – IRL
(+44)(0)20-7193-9751 – UK

A Small External Enterprise Development Team is Cheaper than Your Own

Time is money in the application development business. We have to get to market sooner so someone else does not gazump us, and pip us at the post. We increase the likelihood of this with every delay. Moreover, the longer your in-house team takes to get you through the swamp, the higher the project cost to you.

Of course, in theory this should not be the case. Why bring in a team from outside, and pay more to support their corporate structure? Even going for a contract micro team ought not to make financial sense, because we have to fund their mark-up and their profit taking. Our common sense tells us that this is crazy. But, hold that thought for a minute. What would you say if a small external enterprise development team was actually cheaper? To achieve that, they would have to work faster too.

The costs of an Enterprise Internal Development Team

Even if you were able to keep your own team fully occupied ? which is unlikely in the long term ? having your own digital talent pool works out expensive when you factor in the total cost. Your difficulties begin with the hiring process, especially if you do not fully understand the project topic, and have to subcontract the hiring task.

If you decide to attempt this yourself, your learning curve could push out the project completion date. Whichever way you decide to go, you are up for paying advertising, orientation training, technical upskilling, travel expenses, and salaries all of which are going to rob your time. Moreover, a wrong recruitment decision would cost three times the new employee?s annual salary, and there is no sign of that changing.

But that is not all, not all by far. If want your in-house team to keep their work files in the office, then you are going to have to buy them laptops, plus extra screens so they can keep track of what they are doing. Those laptops are going to need desks, and those employees, chairs to sit in. Plus, you are going to need expensive workspace with good security for your team?s base.

If we really wanted to lay it on, we would add software / cloud costs, telephony, internet access, and ongoing technical training to the growing pile. We did a quick scan on PayScale. The median salary of a computer programmer in Ireland is ?38,000 per year and that is just the beginning. If you need a program manager for your computer software, their salary will be almost double that at ?65,000 annually.

Advantages of R&D outsourcing

The case for a small externally sourced enterprise development team revolves around the opportunity cost ? or loss to put in bluntly ? of hiring your own specialist staff for projects. If you own a smaller business with up to 100 people, you are going to have to find work for idle digital fingers, after you roll out your in-house enterprise project. If you do not, you head down the road towards owning a dysfunctional team lacking a core, shared objective to drive them forward.

Compared to this potential extravagance, hiring a small external enterprise development team on an as-needed basis makes far more sense. Using a good service provider as a ?convenience store? drives enterprise development costs down through the floor, relative to having your own permanent team. Moreover, the major savings that arise are in your hands and free to deploy as opportunities arise. A successful business is quick and nimble, with cash flow on tap for R & D.