April 12, 2004 (Computerworld) --
ROSEMONT, ILL. -- More than a dozen corporate IT auditors attending a conference here last week said they're struggling mightily to document the controls used within their IT departments in time to meet the Sarbanes-Oxley compliance deadlines that most large companies are facing late this year. The biggest challenge in meeting the deadline for documenting internal IT controls as required by Section 404 of the Sarbanes-Oxley Act is a lack of clarity from the government entity that's overseeing compliance regarding which controls should be documented and the best ways to do it, attendees said. They noted that the Public Company Accounting Oversight Board hasn't told companies to use a specific methodology for documenting IT controls, such as COBIT, COSO or ISO 17799. That has made it difficult for the Big Four accounting firms and other external auditors to give advice on which IT controls need to be documented, according to attendees. "It's hard for us to do this when no one is able to tell us exactly what needs to be documented," said an IT auditor who works at a New York-based investment bank. Like almost all of the other auditors interviewed at the conference, she asked not to be identified. William Powers, associate director of the accounting oversight board's inspections division in New York, said the regulatory body plans to devote a lot of attention this year to the IT controls assessment work done by public accounting firms. That work includes the risk-assessment process as well as the documentation and testing of general and application controls. In turn, accounting firms are expected to monitor the IT risk-assessment procedures and information systems audit work that's done by their clients to meet Sarbanes-Oxley mandates, Powers added. But when asked if the oversight board plans to recommend the use of a single IT controls standard, he said, "Absolutely not." Help on the Way The Rolling Meadows, Ill.-based Information Systems Audit and Control Association, which hosted the conference, said it plans to roll out a Web-enabled version of the COBIT standard within a few weeks. The new release of COBIT, which is formally called Control Objectives for Information and related Technology, is designed to help IT auditors browse for best practices, do benchmarking and obtain other guidance as part of Sarbanes-Oxley compliance efforts. In addition to the lack of guidance from regulators, IT auditors said they're also struggling with other issues as part of Sarbanes-Oxley projects. The challenges include identifying a hornet's nest of controls and interfaces among decentralized business units and trying to manage the efforts with scarce resources. For instance, Lynn Kilroy, IT audit director at Allstate Insurance Co. in Northbrook,
"TITLE="IT Blogwatch", where we watch Target pay handsomely for its "failure" to make its Web site work for blind people...."
Read more...
"Gartner Inc. has issued a press release with the headline "Gartner Says Enterprises Must Anticipate How Societal Trends Will Impact..."
Read more... Read more Government & Regulation posts or See all Blogs
Netbooks, ultraportables, mini-notebooks — whatever you call them, they've been grabbing headlines. Are they here for the long term or just a flash in the pan?
Computerworld Executive Briefing: The Compliance Era
Get this briefing free (a $195 value), for a limited time, courtesy of VeriSign. The new Computerworld report, The Compliance Era, explains why regulatory compliance has zoomed to the top of the IT agenda and shows how real-world IT executives are dealing with the storage, security and privacy challenges. Get this briefing free (a $195 value), for a limited time, courtesy of VeriSign. Download this executive briefing
From Laggard to Leader: Transforming the Data Center
From Laggard to Leader: Transforming the Data Center Register for this complimentary live webcast today! Go to the webcast
Qualified Security Assessors are not created equal
Download this whitepaper, free for a limited time, compliments of VeriSign! (Source: VeriSign) Learn how a Qualified Security Assessor (QSA) can help you acheive full compliance and security in this white paper, presented by VeriSign and Computerworld. Download this white paper
White Papers
Read up on the latest ideas and technologies from companies that sell hardware, software and services.
Eliminate SPAM, Gain Productivity Learn all about the dangers and the costs of spam in all its forms – from stock-touting to spreadsheet. Also, understand the drawbacks of traditional hardware- and software-based defenses – and the unique benefits of MessageLabs multi-layered, managed Anti-Spam solution; as illustrated by a real-world case study where MessageLabs stopped spam cold.
Download this white paper now! See more Whitepapers
The Spy Files For Congress to do anything that helps protect consumers and the critical Internet infrastructure as a whole, it must pass laws that require proactive processes to protect computers, not that tell people how to deal with the resulting mess, says Ira Winkler.
Customer Satisfaction with Email Archiving Systems Osterman Research conducted a primary survey asking organizations about a variety of archiving systems to understand the level of satisfaction that customers of Sunbelt Exchange Archiver (SEA) and other email archiving offerings report on a variety of metrics related to product and vendor performance. Download this white paper now!
See your link here
Subscribe to
Computerworld 
or
Other Legislation/Regulation Stories
Get this briefing free (a $195 value), for a limited time, courtesy of VeriSign. 
From Laggard to Leader: Transforming the Data Center
Download this whitepaper, free for a limited time, compliments of VeriSign!
Read up on the latest ideas and technologies from companies that sell hardware, software and services. 
Since You Asked
Learn all about the dangers and the costs of spam in all its forms – from stock-touting to spreadsheet. Also, understand the drawbacks of traditional hardware- and software-based defenses – and the unique benefits of MessageLabs multi-layered, managed Anti-Spam solution; as illustrated by a real-world case study where MessageLabs stopped spam cold.
Download this white paper now! 
The Spy Files
Osterman Research conducted a primary survey asking organizations about a variety of archiving systems to understand the level of satisfaction that customers of Sunbelt Exchange Archiver (SEA) and other email archiving offerings report on a variety of metrics related to product and vendor performance.