Double Dipping on SOX
Some companies are leveraging Sarbanes-Oxley investments for business; others are leveraging business investments to comply.
November 7, 2005 12:00 PM ETComputerworld -
Mention the Sarbanes-Oxley Act to a CIO or a corporate executive, and he's likely to roll his eyes or grimace.
That's because most executives view the compliance requirements as a grim burden, like cleaning out a pack rat's basement.
Large public companies have had to devote thousands of staff hours and invest millions of dollars to identify, document and audit internal controls within their organizations just to comply with Section 404 of the federal law. Often the result has been that other strategic initiatives and revenue-enhancing IT projects had to be put on the back burner.
Those pressures have continued unabated in 2005. U.S. companies are expected to spend nearly $15.5 billion on compliance-related activities this year, with technology spending on Sarbanes-Oxley alone expected to top $1.7 billion, according to Boston-based AMR Research Inc.
Mindful of these investments, some savvy companies have leveraged their Sarbanes-Oxley spending to benefit the business in ways that go beyond mere regulatory compliance, yielding more bang for the buck.

![]()
Kim Van Nostern, chief information security officer at Allstate Insurance ![]()
Two years ago, Allstate developed its own compliance and control management system to help document controls in its various IT divisions. One of those tools is a scanning system created last year to identify worms and viruses and prevent them from attacking any of Allstate's systems.
Beyond helping Allstate ensure that it has effective security controls in order to comply with Sarbanes-Oxley, the scanning tool has delivered a nice side benefit. It enables the company's asset management specialists to constantly survey Allstate's corporate network and identify and track PCs, servers and other pieces of equipment that they previously didn't have a record of, says Van Nostern.
Catching Exceptions
At the end of 2004, American Electric Power Co. (AEP) began using software from Oversight Systems Inc. in Atlanta to help it monitor transactions in its accounts payable group. If a manager authorizes a purchase above his spending limit, the system recognizes it and spits out an exception report, says Mike Sullivan, assistant controller at the Columbus, Ohio-based power company.
Those capabilities have helped AEP comply with Section 404 requirements. But
IT Management
Additional Resources



White Papers & Webcasts
Oracle Accelerate - Not Just Smart but Timely
Download Now!
Data in Action: Making the Planet Smarter
Register Now
The Workday User Experience Video
Watch Workday's Creative Director, Scott Lietzke, discuss the business-centered design philosophy at Workday.
Rapid Implementation: The New Age of ERP
Download Now!
Business Process Framework Demo
Learn about Configurable Business Processes and Calculated Fields. Watch Now!
Manager Experience Demo
Go beyond self-service solutions to perform more effectively. Watch Now.
Faster, Cheaper and Easier to Maintain
Can you afford not to upgrade your servers to today's advanced, energy-efficient technologies?
Manjit Singh,CIO, Chiquita Brands - Video
View this video now.

