Sarbanes-Oxley Compliance

[BoomerD]

I need some help with a school project.

We have to evaluate Sarbanes-Oxley Compliance software solutions.

There's a bazillion websites out there that claim to have "THE" solution, but little real information. I've waded through countless websites, read numerous "whitepapers" on the subject, and still don't really know a dammed thing about this stuff.

What do your companies do to comply with this myriad of laws?

Do you use a software solution?

Do you deal with compliance inhouse or use a consultant?

Do you get compliance just by adhering to the rules without any software/consultants?



Our limited parameters are:

Constraints.
1) No one in your company can give you a clear definition of what SOX Compliance is - so you must \"educate management.
2) The company is running on a patch work quilt of financial systems.
3) The budget is limited and management will allocate one head count to running and maintaining the software.
4) Your company is publicly traded.

I told my professor that if my company gave me this assignment with as vague of parameters as he did for this assignment, I'd just tell the boss to fire me on the spot...


ANY help will be appreciated.

 

[Tweak155]

Sarbanes-Oxley - Nicknamed "SOX" is a nightmare here.

From my experience, a private company does not have to comply with these guidelines. The only reason we started to implement this is because we planned to go public.

That being said:

We comply with worthless stuff. We use windows logins to monitor activity. It is the lamest thing on earth.

We do not use a 3rd party program to implement.

Inhouse compliance. We have auditors that fly out to check on it.

Adhere without software. Not 100% sure on the consultants. My guess is at 1 point we did have them, but they are now gone and we still aren't compliant 100%.

 

[BoomerD]

Yeah, from what I can tell, a lot of private companies get SOX compliant just for the transparency in financial accounting.

We can all thank the fuckers at Enron, Arthur Anderson, Global Crossing, and Worldcom (among others) for this bullshit.

 

[Dr. Detroit]

Main reason why I left the Big 4 was SOX.

The IT environment needs to be secure - Security over servers with restricted access points
Passwords- should have mandatory changes quarterly
users of the financial software should be restricted
restricted access to only those modules each user is granted
change access needs to be monitored.
Security over backups
Change logs, when data is changed, reports can be ran and management reviews changes
IT steering committee should be formed to discuss future upgrades
Before going live testing should be performed


Solution: Install Oracle and customize the living crap out of it.