How COBIT helps you achieve SOX Compliance

First released way back in 1996, COBIT has already been around for quite a while. One reason why it never took off was because companies were never compelled to use it ? until now. Today, many CEOs and CIOs are finding it to be a vital tool for achieving SOX compliance in IT.

Thanks to SOX, COBIT (Control Objectives for Information and related Technology) is now one of the most widely accepted source of guidance among companies who have IT integrated with their accounting/financial systems. It has also gained general acceptability with third parties and regulators. But how did this happen?

Role of control frameworks in SOX compliance

You see, the Sarbanes-Oxley Act, despite having clearly manifested the urgency of establishing effective internal controls, does not provide a road map for you to follow nor does it specify a yardstick to help you determine whether an acceptable mileage in the right direction has already been achieved.

In other words, if you were a CIO and you wanted to find guidance on what steps you had to take to achieve compliance, you wouldn’t be able to find the answers in the legislation itself.

That can be a big problem. Two of your main SOX compliance obligations as a CEO or CIO is to assume responsibility in establishing internal controls over financial reporting and to certify their effectiveness. After that, the external auditors are supposed to attest to your assertions. Obviously, there has to be a well-defined basis before you can make such assertions and auditors can attest to anything.

In the language of auditors, this ?well-defined basis? is known as a control framework. Simply put, once you certify the presence of adequate internal controls in your organisation, the external auditor will ask, ?What control framework did you use??

Knowing what control framework you employed will help external auditors determine how to proceed with their evaluations and tests. For your part, a control framework can serve as a guide to help you work towards specific objectives for achieving compliance. Both of you can use it as a common reference point before drawing any conclusions regarding your controls.

But there are many control frameworks out there. What should you use?

How SOX, COSO, and COBIT fit together

Fortunately, despite SOX?s silence regarding control frameworks, you aren’t left entirely to your own devices. You could actually take a hint from the SEC and PCAOB, two of the lead organisations responsible for implementing SOX. SEC and PCAOB point to the adoption of any widely accepted control framework.

In this regard, they both highly endorse COSO, a well-established internal control framework formulated by the Committee of Sponsoring Organisations of the Treadway Commission (COSO). Now, I must tell you, if you’re looking specifically for instructions pertaining to IT controls, you won’t find those in COSO either.

Although COSO is the most established control framework for enterprise governance and risk management you’ll ever find (and in fact, it’s what we recommend for your general accounting processes), it lacks many IT-related details. What is therefore needed for your IT processes is a framework that, in addition to being highly aligned with COSO, also provides more detailed considerations for IT.

This is where COBIT fits the bill.

How COBIT can contribute to your regulatory compliance endeavors

COBIT builds upon and adheres with COSO while providing a finer grain of detail focused on IT. You can even find a mapping between COBIT IT processes and COSO components within the COBIT document itself.

Designed with regulatory compliance in mind, COBIT lays down a clear path for developing policies and good practice for IT control, thus enabling you to bridge the gap between control requirements, technical issues, and business risks.

Some of the components you’ll find in COBIT include:

IT control objectives

These are statements defining specific desired results that, as a whole, characterise a well-managed IT process. They come in two forms for each COBIT-defined IT process: a high-level control objective and a number of detailed control objectives. These objectives will enable you to have a sense of direction by telling you exactly what you need to aim for.

Maturity models

These are used as benchmarks that give you a relative measurement stating where your level of management or control over an IT process or high-level control objective stands. It serves as a basis for setting as-is and to-be positions and enables support for gap analysis, which determines what needs to be done to achieve a chosen level. Basically, if a control objective points you to a direction, then its corresponding maturity model tells you how far in that direction you’ve gone.

RACI charts

These charts tell you who (e.g. CEO, CFO, Head of Operations, Head of IT Administration) should be Responsible, Accountable, Consulted, and Informed for each activity.

Goals and Metrics

These are sets of goals along with the corresponding metrics that allow you to measure against those goals. Goals and metrics are defined in three levels: IT goals and metrics, which define what business expects from IT; process goals and metrics, which define what the IT process should deliver to support It’s objectives; and activity goals and metrics, which measure how well the process is performing.

In addition to those, you’ll also find mappings of each process to the information criteria involved, IT resources that need to be leveraged, and the governance focus areas that are affected.

Everything is presented in a logical and manageable structure, so that you can easily draw connections between IT processes and business goals, which will in turn help you decide what appropriate governance and control is needed. Ultimately, COBIT can equip you with the right tools to maintain a cost-benefit balance as you work towards achieving SOX compliance.

Check our similar posts

Web Analytics

There’s a vast ocean of raw customer data on the Web. Ever thought of the implications if somehow you could harness all that data and transform it into useful information? Information that perhaps you can use in your SEO (Search Engine Optimisation) and conversion optimisation?

There are web analytics tools you can employ for these purposes. But using web analytics tools will only win you half the battle. You’ll have to be proficient in configuring these tools to generate insightful and actionable results out of them. A poorly configured tool can produce confusing or even misleading information.

Our web analysts possess the expertise to configure and use web analytics tools, as well as analyse results and leverage information obtained from them.

These are the things we can do to help you take advantage of web analytics.

  • Discuss with your managers to establish your specific goals, to determine what specific data we have to collect/analyse and to plan out how to go about with the entire process.
  • Help you select an appropriate tool, install it and set optimal configurations including page tags, filters, funnels, reports and others.
  • Wield the full force of your analytics tool(s) to make sound business decisions.
  • Monitor the entire web analytics system and implement adjustments when needed.
Successful Engineer Communication With FieldElite

Technological innovations have been on the rise in the recent past. Our news media are awash with new technologies that are being released in almost every industry. From smart buildings to sophisticated gadgets, every industry has a technological invention to flaunt. 

One area in which technology has blossomed is the field service. In the field service management, things have moved a notch higher. Right from communication, document management, monitoring and evaluation, to information storage, nothing remains where it was a couple of years ago. You no longer have to carry clipboards around to do your inspections or pile files in the office. You no longer have to wait for your field service employees to return to the office before you can receive reports. By using a field service management software like FieldElite, you have it all done at a click. 

With FieldElite, you’ve got everything under control right from the comfort of your office. Provided you’re doing what you need to do and posting updates using the app, the rest will fall into place. Your employees will receive updates from you and vice versa. If there is a client who needs attention, they can easily issue a request through the app and the next available field service officer who?s within proximity will pick it up and attend to the customer?s needs. 

Everything is just a click away. Sounds great, right?

FieldElite is a robust field service management software that’s packed with a wide array of tools meant to simplify communication between the office and the field service employees. With FieldElite, you can reach all your engineers at one go. 

Below are a few of the communication features that make FieldElite the software of choice when it comes to field service management.

Simplified Communication

It’s very important to stay in touch with your engineers in the field to monitor the ongoing activities. For this reason, you need to choose a platform that doesn’t complicate the process. You don’t want important information to reach your team late. That would drag your activities.

Fast and effective communication is, therefore, very key in field service. FieldElite has consequently been made to simplify communication in the field service. Its simplicity can be compared to the usual consumer messaging apps. On the back-end, however, there are very many complex procedures executed through refined algorithms meant to process information and generate instant reports for engineers, supervisors, and the rest of the company team members.  

With the FieldElite app, communication is as easy as dropping a message in the team members? inbox. Again, the app?s communication system is centralised and, thus, every communication trail is easily retrievable. You don’t need different apps for messaging, audio and video calling, and document sharing. You have it all in FieldElite. Simply put, FieldElite is an all-in-one field service management tool that ropes in all essential digital modes of communication. 

But what’s the benefit of having all work-related communication in one place? 

With an all-in-one communication platform like FieldElite, you’ll cut down on wasted time and field tech frustration. Again, any urgent information will reach your engineers on time, and none of them will be left out. What’s more? With effective communication, expect the performance of your team to shoot up. 

Consistent Communication

Field technicians, in this case engineers, need to be kept on toes to get the job done. You can only achieve this by communicating with them more often. Therefore, you need a field service management platform that can offer you that. Most field service management software facilitates constant communication with team members in the field. Even so, not all are as good as you expect. So, you’ve got to be a bit more critical when choosing a field service management software for your business. 

A good field service management software is one that enables you to regularly check in with field techs to make sure that they have everything they need. With FieldElite, you can achieve more than this. FieldElite app allows you to communicate with your engineers from time to time through messages, calls, or shared documents. Again, the team gets information at the same time. 

So, how important is regular communication with your business? 

Keeping in touch with your team members in the field helps you build strong relationships with them. Additionally, you can easily spot areas that need improvement that otherwise could have been hidden from your viewpoint. What’s more? Employees feel valued when you check on them from time to time. As a result, this will boost their overall productivity, which contributes positively to the well-being of your business.

So, take your business to another level by making use of FieldElite communication tools to reach out to your engineers at any time.

Two-Way Communication

Communication in field service can only be successful if you can get feedback from your field techs. As such, the field management software should make it easier for your engineers to notify you of anything that needs urgent attention. With the FieldElite app?s communication features, your engineers can give you real-time updates from any device. The app is compatible with any android device, and, therefore, the field techs can use their smart handsets to communicate important information. 

The messaging and calling features are easy to manipulate, and with a little training, anyone can use them easily. Again, FieldElite allows you to make group calls or send many messages at the same time. Therefore, in case you?d like to talk to the entire team, you can choose to make a group call or send out bulk messages. 

Real-Time Updates

With FieldElite, you don’t need to wait until you meet your team to communicate any changes. You can notify your team on any work-related changes anytime, and as many times as is necessary. The good thing about FieldElite is that the information reaches all your engineers instantly and at the same time. Provided there?s strong network coverage, you’ll not have to deal with delayed communication. Again, your field techs can always get back to you in case they need clarifications on some matters.

Timely updates are very necessary for field service management. Field techs that get real-time updates tend to be more productive than those who get information late. At least they can make necessary changes on time to avoid wasting time on tasks that aren’t urgent. Therefore, make use of FieldElite communication features to keep your engineers updated.

Would you like to take your business to another level? Well, it’s time to improve communication with your field techs. Get the FieldElite android app for successful communication with your engineers.

Authentication and Access Control

Threats to your data can come from external or internal sources.

  1. There are individuals who don’t have the authorisation but are driven by malicious intentions to gain access to certain information. This may refer to individuals who already belong to your organisation (but don’t have the necessary access rights) as well as those who don’t.
  2. There are individuals who have both the authorisation and, unfortunately, the malicious intentions over certain information.
  3. Finally, there are individuals who have the authorisation, no malicious intentions, but have accidentally exposed the information in question to those without the proper authority.

While curbing threats 2 and 3 would require other methods, threat #1 can be countered if the right authentication and access control systems are in place.

Here’s what we can do for you:

  • Work with your key personnel to determine who gets access to what.
  • Help you decide whether a single factor or a two-factor authentication (2FA) is appropriate for your organisation and recommend which factors are most suitable. Login methods may include but are not limited to the following:
    • biometric devices
    • Kerberos tickets
    • mobile phones
    • passwords
    • PKI certificates
    • proximity cards
    • smart cards
    • tokens
  • Install the necessary infrastructure needed for the factors chosen. For instance, if you opt to use biometrics, then biometric scanners will be installed. We’ll make sure that the authentication terminals are situated in places where achieving optimal traffic and work flow has been taken into consideration.

Other defences we’re capable of putting up include:

Ready to work with Denizon?

Contact Us Today