CIO and IT Manager Newsletter
Janco Associates, Inc

July, 2008 - Volume 08 - Issue 7

Risks and Regulatory Requirements Drive Security Implementations

 It is well understood that Enterprise solutions are complex. In addition, regulations are becoming more complex. And there are more of them. Of all the new regulations, the Sarbanes-Oxley Act (SOX) in the US has definitely garnered the most attention.

Risks and regulatory requirements are nothing new to business. What is new is their size and severity. Enterprise wide solutions have higher risks since they are in the realm of total solutions. New regulations have sharper teeth and deeper impact. They have caught the attention of board members and management at all levels.

But governments are not the only pressure point. Customers are placing demands on companies as well. Take the special mandates in the US from Wal-Mart or the Department of Defense, for example, on suppliers fixing RFID tags on shipments. Also one should not forget that businesses may have their own self-imposed set of ethics, fairness and sustainability policies.

It is certainly been a catalyst for change in companies and industries of all sizes. Yet, SOX is only one piece of a larger regulatory puzzle. Regulations in data security, privacy, records retention, human resources, payroll and taxes, risk management, health and safety, bio-terrorism, homeland security, international trade and environment are all putting pressure on companies. Failure to comply in any of these areas can mean stiff penalties: directors may be sent to jail, and companies may be fined and even shut down.

Businesses need to leverage technology to meet compliance challenges quickly across an enterprise, be able to scale across geographies and reuse common technologies across multiple compliance issues to lower overall cost of compliance. Relying on manual processes or taking a fragmented approach to compliance can be fatal as a company's reputation is at stake in the business and capital markets. One serious incident and a company could lose that valuable reputation and its customers along with it. Companies certainly understand that compliance in an Enterprise solution wide environment is not  a one-time thing. It is here to stay. Smart companies are moving forward on that assumption, which is why they are making
compliance, risk management and corporate governance an important part of their corporate strategies.

Read on .....

Definition of Sarbanes-Oxley Compliance

It can be a struggle for a company to adhere to new compliance regulations and responsibilities. The concerns about where do we start? Can we leverage existing processes to meet these new requirements? Are obvious questions with not-so-obvious answers. What are the vulnerabilities and how can we manage compliance with SOX section 404.

As guidance and a framework for SOX compliance, the US Securities and Exchange Commission (SEC) has mandated that affected organizations use a recognized internal control framework. The SEC makes specific reference to the recommendations of the Committee of the Sponsoring Organizations of the Treadway Commission (COSO). While there are many sections within the Sarbanes-Oxley Act, the focus here is on section 404, which addresses internal control over financial reporting. This section requires the management of public companies to assess the effectiveness of the organization's internal control over financial reporting and annually report the result of that assessment.

Meeting the COSO objective means compliance with SOX section 404.

The Sarbanes-Oxley Act has fundamentally changed the business and regulatory environment. The Act aims to enhance corporate governance through measures that will strengthen internal checks and balances and, ultimately, strengthen corporate accountability. However, it is important to emphasize that section 404 does not require senior management and business process owners merely to establish and maintain an adequate internal control structure, but also to assess its effectiveness on an annual basis. This distinction is significant.

Read on....