Sarb-Ox Docs Cost a Lot More ...

Computerworld - ... than most people think. AMR Research Inc. in Boston estimates that the average company will blow through about $1 million in Sarbanes-Oxley costs per $1 billion in revenue, just to do what analyst John Hagerty calls "a document exercise" that organizes
everything for their auditors. Worse, unlike Y2k, which was a one-time crunch, compliance with the Sarbanes-Oxley Act is an annual event like tax preparations -- but possibly even less fun. What contributes greatly to the cost, observes Neal Selvin, chief marketing officer at Vienna, Va.-based Approva Corp., is the fact that "auditors have homegrown rule books, and they don't have to tell customers what they're looking for." So companies search hither and yon for every conceivable compliance-related document because they don't want to get into hot water with the Securities and Exchange Commission, which Selvin predicts "will make an example of a few people to prove that SOX has teeth." How? Delisting companies from stock exchanges could be a popular punishment among the SEC's lawyers. And sending executives to jail likely will continue to be a crowd pleaser with them. If you're not already prepping for your audit, well, good luck. But you can still call Selvin. He claims that his software, BizRights 2.1, is based on real rules, written by real auditors whom Approva has lured away from PricewaterhouseCoopers, Ernst & Young and other firms. BizRights currently works with any SAP installation, but in early 2005 Approva will add PeopleSoft's applications to its auditing prowess. Starting at $100,000, BizRights isn't cheap - but it costs less than doing it yourself, it appears.
Raid your compliance budget ...
... to get your software and hardware assets in order. That might be the strategy some CIOs are taking, given the uptick in business that Altiris Inc. is attributing to regulatory compliance requirements. Lindon, Utah-based Altiris makes tools to centrally manage IT assets throughout their life cycles, and Chief Technology Officer Dwain Kinghorn says some IT executives think ensuring that each device has the right software configuration and is secured will help them pass compliance audits. For example, he points out that handheld computers being used in the field need to be properly accounted for, with all end-user rights and privileges assigned by and known to IT. Plus, you have to be able to automatically destroy data on handhelds if they're not synchronized regularly with servers, in case they have been lost or stolen. Kinghorn says these security features will be added to the Altiris Client Management Suite in