 
  See your link here
|
For more info on a specific newsletter, click the title. Details will be displayed in a new window.
Subscribe to
Computerworld 40 years of the most authoritative source of news and information for IT leaders.
IT scrambles to meet Sarb-Ox controls deadline
or
Other Legislation/Regulation Stories
|
|
|
|
October 18, 2004 (Computerworld) --
IT departments at many large companies are racing to document, remediate and test IT-related controls to meet a year-end reporting deadline for Sarbanes-Oxley compliance.
The rush is on because many companies failed to grasp the amount of work that would be required and because of miscommunication between IT managers and the finance departments that typically run Sarbanes-Oxley Act compliance projects, according to users and analysts who were interviewed last week.
"What I've seen is a 'Let's drop everything and get this done' approach on dealing with IT controls from the second quarter until now," said John Hagerty, an analyst at AMR Research Inc. in Boston.
Hagerty and several other analysts and consultants said they expect that most companies that need to show Sarb-Ox compliance by year's end will get the bulk of their IT controls documented and tested in time. But some analysts predicted that in annual 10-K reports early next year, as many as 25% of the so-called accelerated filers will have to report controls-related exceptions that require additional remediation. Depending on the severity of the problems, companies could be fined by the U.S. Securities and Exchange Commission.
Todd Naughton, vice president and controller at Zebra Technologies Corp., said the Vernon Hills, Ill.-based supplier of printer components "really just started looking" at general IT controls within the past three months.
For the past year, Zebra has focused on documenting, remediating and testing application-level controls throughout the organization, including mapping defined job roles to the system access levels they require, said Richard Jaszka, the company's internal audit manager.
"That said, we're concerned about our ability to meet the Section 404 requirements of Sarbanes-Oxley for the other IT controls," said Jaszka. For example, although Zebra has documented policies for key areas such as change management, systems development and mission-critical computer operations, "it will be a challenge to properly test these controls and address any necessary remedies by year-end," Jaszka said.
He added that regulators haven't specified which IT controls need to be documented and tested.
Compliance Gap
Stan Lepeak, an analyst at Meta Group Inc., said he wouldn't be surprised if 25% of accelerated filers are found to have inadequate controls. He based his estimate on several factors, including discussions with clients, Sarbanes-Oxley readiness surveys conducted with client firms, and concerns expressed by customers who outsource IT that service providers won't be able to document the IT controls in time.
"It really depends on how strict external auditors will be in determining what are material weaknesses or deficiencies in controls and what aren't," said Lepeak.
Herman Miller Inc., a Zeeland, Mich.-based maker of office furniture, decided this past spring to adopt a set of guidelines for evaluating IT controls called Control Objectives for Information and Related Technologies, or Cobit, created by the IT Governance Institute and the Information Systems Audit and Control Association, both of which are based in Rolling Meadows, Ill., said Rich Russell, director of application development.
|
Print this Story |
|
Send Us Feedback |
|
E-mail this Story |
|
Digg this Story |
|
Slashdot this Story |
|
|
|
|
|
|
|
 |
| All Zones Application Performance Zone Business Continuity Zone Data Center Management Zone Enterprise-Class Security Zone The File Data Management Zone Security Management Zone ITIL Best Practices Zone The SAS Zone Storage Virtualization Zone Business Intelligence and Analytics Zone Identity & Security Management Zone |
|
See your link here
|
 |
||||||||
| ||||||||
| ||||||||
| ||||||||
|
Get this briefing free (a $195 value), for a limited time, courtesy of VeriSign. 
Long Tail Supplier Collaboration - What's In It For You? 
Download this whitepaper, free for a limited time, compliments of Webroot Software!
Read up on the latest ideas and technologies from companies that sell hardware, software and services. 
- Microsoft: We'll help other vendors find, fix their bugs
- Russian hacker gang steals with impunity, says researcher
- Free Windows XP tuneup: Put new life into an old workhorse
- More top stories
 Since You AskedA weekly storage column from storage analyst, Steve Duplessie of the Enterprise Strategy Group |
Eliminate SPAM, Gain Productivity Learn all about the dangers and the costs of spam in all its forms – from stock-touting to spreadsheet. Also, understand the drawbacks of traditional hardware- and software-based defenses – and the unique benefits of MessageLabs multi-layered, managed Anti-Spam solution; as illustrated by a real-world case study where MessageLabs stopped spam cold.
Download this white paper now!
See more Whitepapers |
 The Spy FilesFor Congress to do anything that helps protect consumers and the critical Internet infrastructure as a whole, it must pass laws that require proactive processes to protect computers, not that tell people how to deal with the resulting mess, says Ira Winkler. Click here to read the latest column by Ira Winkler |
Customer Satisfaction with Email Archiving Systems Osterman Research conducted a primary survey asking organizations about a variety of archiving systems to understand the level of satisfaction that customers of Sunbelt Exchange Archiver (SEA) and other email archiving offerings report on a variety of metrics related to product and vendor performance.Download this white paper now!
|