June 30, 2003 (Computerworld) --
There's a giant sigh of relief rising in the executive suites and corporate boardrooms of large, publicly held companies around the country. Why? Because the U.S. Securities and Exchange Commission has postponed implementing certain key sections of the Sarbanes-Oxley Act for nine months. This gives the SEC more time to complete the regulations that all SEC-regulated companies will have to follow. Postponing SarbOx (as it's affectionately called) will give CEOs, CFOs and external auditors more time to institute procedures for keeping track of all financial information, from the moment of inception to the final submission in an annual report to the SEC. It also delays the SarbOx mandate that every public company submit an annual report to the SEC that assesses the effectiveness of its internal controls for financial reporting. Sounds like a purely financial issue, right? Not quite. Yes, SarbOx is fundamentally financial legislation. Enacted in part as a reaction to Enron and other corporate financial scandals, the law's goal is for public companies to produce more complete and accurate financial reports. The emphasis on internal controls, however, goes far beyond policies, procedures and external audits. The SEC still must define what "internal controls" means in terms of compliance regulations, but one thing is almost certain: Any public company that utilizes IT as part of its financial business processes will find that IT controls are included in the definition. SarbOx compliance could also mean an overhaul or upgrade of financial transaction and reporting systems for most companies, regardless of size, in order to meet regulatory requirements for more accurate, more detailed and speedier filings. So far, CIOs have been warming the bench, while CEOs, CFOs, attorneys and auditors attempt to address known and anticipated SarbOx compliance issues. Now is the time for the CIO to get into the game and step up to take the lead on the IT control issue. The CIO should view the IT organization and infrastructure as if he were the CEO of a "business within the business." Would the CIO be comfortable putting his neck on the line during a SarbOx compliance audit? Probably not. Although regulations haven't been defined for compliance with SarbOx Section 404 -- which mandates an audit of internal controls -- there are a number of areas where the CIO can apply common sense and best practices to comply with the act's goals. Examining the control processes within the IT organization relating to financial systems is the logical place to start. For example, segregation of duties within the systems development staff is a widely recognized best practice that helps prevent errors and outright fraud. The people who code program changes should be different from the people who test them, and a separate team should be responsible for production change control. Homegrown financial systems are fraught with potential data-integrity problems, but packaged systems aren't totally immune, either. Although leading ERP systems offer audit-trail functionality, customizations of these systems often bypass those controls. The CIO has to work with internal and external auditors to ensure that customizations can pass muster. Closely related to development and change controls are project management methodologies. The leading cause of systems implementation failure continues to be poor project management. The CIO must ensure that the IT department has a process to ensure a successful selection and implementation of new or upgraded financial systems within defined schedules, budgets and acceptable levels of risk. Records management is another area of concern for the CIO as the long-term custodian of corporate data. How a company stores and transmits electronic documents -- and whether or not they're deleted -- can have significant legal and financial consequences. The CIO should work with the CEO, CFO and corporate attorneys to create a document-retention-and-destruction policy that addresses what types of electronic documents should be saved -- and for how long. Ultimately, SarbOx compliance will require a close working relationship involving the CEO, CFO and CIO. Getting into the game starts with running IT as a business and strengthening IT internal controls. Norbert J. Kubilus is a partner at Tatum CIO Partners LLP in San Diego. He can be reached at Norbert.Kubilus@tatumpartners.com.
"Mo' problems in Thursday's IT Blogwatch, as Microsoft and Novell extend their "deadly" embrace. Not to mention George Lucas's new..."
Read more...
"Here's a first: Microsoft faces an anti-trust investigation in Taiwan because it no longer sells XP. Microsoft has been targeted..."
Read more... Read more Government & Regulation posts or See all Blogs
The x86's lineage can be traced back to 1968, to a design on a napkin drawn by Austin O. "Gus" Roche, an all-but-forgotten engineer in Texas who was obsessed with creating a personal computer.
Computerworld Executive Briefing: The Compliance Era
Get this briefing free (a $195 value), for a limited time, courtesy of VeriSign. The new Computerworld report, The Compliance Era, explains why regulatory compliance has zoomed to the top of the IT agenda and shows how real-world IT executives are dealing with the storage, security and privacy challenges. Get this briefing free (a $195 value), for a limited time, courtesy of VeriSign. Download this executive briefing
Long Tail Supplier Collaboration - What's In It For You?
Long Tail Supplier Collaboration - What's In It For You? Download this webcast, free, compliments of Sterling Commerce Go to the webcast
Web Security SaaS: The Next Generation of Web Security
Download this whitepaper, free for a limited time, compliments of Webroot Software! (Source: Webroot Software) The Web is the new threat vector of choice for hackers and cybercriminals to distribute malware and perpetrate identity theft, financial fraud, and corporate espionage. This paper outlines the challenges facing many SMBs and provides solutions for overall security effectiveness and reducing the burden on IT departments. Download this white paper
White Papers
Read up on the latest ideas and technologies from companies that sell hardware, software and services.
Eliminate SPAM, Gain Productivity Learn all about the dangers and the costs of spam in all its forms – from stock-touting to spreadsheet. Also, understand the drawbacks of traditional hardware- and software-based defenses – and the unique benefits of MessageLabs multi-layered, managed Anti-Spam solution; as illustrated by a real-world case study where MessageLabs stopped spam cold.
Download this white paper now! See more Whitepapers
The Spy Files For Congress to do anything that helps protect consumers and the critical Internet infrastructure as a whole, it must pass laws that require proactive processes to protect computers, not that tell people how to deal with the resulting mess, says Ira Winkler.
Customer Satisfaction with Email Archiving Systems Osterman Research conducted a primary survey asking organizations about a variety of archiving systems to understand the level of satisfaction that customers of Sunbelt Exchange Archiver (SEA) and other email archiving offerings report on a variety of metrics related to product and vendor performance. Download this white paper now!
See your link here
Subscribe to
Computerworld 
or
Other Legislation/Regulation Stories
Get this briefing free (a $195 value), for a limited time, courtesy of VeriSign. 
Long Tail Supplier Collaboration - What's In It For You? 
Download this whitepaper, free for a limited time, compliments of Webroot Software!
Read up on the latest ideas and technologies from companies that sell hardware, software and services. 
Since You Asked
Learn all about the dangers and the costs of spam in all its forms – from stock-touting to spreadsheet. Also, understand the drawbacks of traditional hardware- and software-based defenses – and the unique benefits of MessageLabs multi-layered, managed Anti-Spam solution; as illustrated by a real-world case study where MessageLabs stopped spam cold.
Download this white paper now! 
The Spy Files
Osterman Research conducted a primary survey asking organizations about a variety of archiving systems to understand the level of satisfaction that customers of Sunbelt Exchange Archiver (SEA) and other email archiving offerings report on a variety of metrics related to product and vendor performance.