Sarbanes-Oxley Act (SOX) Audit Requirements

Sarbanes-Oxley Act (SOX), passed in 2002, spells out requirements for internal controls.  Some organizations have turned to the standards published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). These do not, however, provide specific guidelines for organizations that deal with databases, a key area of concern for SOX compliance, but instead provide an excellent conceptual architecture for organizations to build a compliant IT Control framework for the enterprise.  Others are relying upon the best practices set forth by COBIT (Control Objectives for Information and related Technology) and ITIL (Information Technology Infrastructure Library). However, these frameworks are incomplete with regards to the concerns set forth under SOX relating to databases. Databases are at the center of SOX control issue. Ensuring effective controls over database activity—writes, deletes, changes, and administration—is absolutely crucial to maintaining data integrity.  Control must also extend to server and mainframe applications and unstructured data. Meeting SOX compliance centers on four areas:  audit trails, segregation of duties, change control, and patch management.  

Audit Trails

Companies need to answer who changed a record, who deleted a record, changes to a schema, with particular detailed attention to privileged users.  These audit logs are usually a normal by-product of most database and application tools.  There needs to be a process to regularly review patterns and to store the logs for at least 5 years. 

Segregation of Duties

The Information Systems Audit and Control Association (ISACA) has issued guidelines calling for IT organizations to assign clear job roles and functions, and to assign database and system permissions according to those roles and functions. Please refer to www.isaca.org and the publication titled Control Objectives for Sarbanes-Oxley 2^nd Edition for additional detail.   

Change Control

Organizations need to document changes to their technical environment and adoption of ITIL’s Change and Release Management play a crucial role in satisfying this area.

Patch Management

Applications and associated databases should be patched on a predefined schedule that takes into account the peak usage periods for these systems, while providing substantial review of the patches with adequate testing. There are some other internal controls over financial reporting (ICoFR) that relate to database auditing and include:

• Network access should be limited only to certain defined systems (via strong firewall and IP restrictions).

• Unnecessary service access should be blocked at the network access device.  This would be satisfied by “hardened” proxy servers.

• Frequent review of user accounts and passwords should regularly verify that all permissions reflect actual user roles and responsibilities.  This has given rise to a number of products associated with Identity Management (IM) and Network Access Control (NAC).

These should be performed several times a year, in alignment with HR systems and general identity management solutions.

• Financial transactions are properly recorded by authorized users
• Data has not been compromised by unauthorized or authorized means
• All changes to the financial data are monitored

Achieving these controls presents IT managers with the challenge of auditing (and maintaining an audit history) for a variety of SOX-related activity, including all:

• privileged user activity
• changes to user privileges
• failed login attempts
• logical access failures
• database schema changes
• direct data access events

Technorati

Outsourcing Analysis and Avoiding Failure

In today’s economy, businesses face enormous hurdles no matter what their particular business endeavor.  Competition from larger, more established firms, globalization, the looming potential for technological obsolescence and the need to keep costs under control can make management of most companies an extreme challenge. Focusing on the core business can be difficult especially when growth – and success – force management to shift its attention from the market and ‘getting ahead’ to the company’s own, internal structures. A strategic tool for CEOs is business process outsourcing. Through the process of outsourcing, analysts say, companies can regain focus on their particular business, become more efficient and even rival the systems and control level of larger companies in outsourced processes and most importantly focus their efforts on the value-added functions of their business.  According to many respected reports, it certainly can help a company’s bottom line.  However, there are many factors to consider before venturing into the burgeoning world of outsourcing.

Mistakes typically made with outsourcing

•  Trying to outsource a function that has high costs, minimal processes, and is causing considerable management angst; at least try to take the excess costs out before you outsource.  Don’t give someone else your savings margin.

•  Not developing a business case and strategy on what to outsource, thereby making it difficult to assess cost and process improvement proposals from vendors.

• Not establishing a method of performance measurement upfront during the contract phase.

• Failing to consider the long-term relationship dynamics.

• Not planning upfront how the relationship might end.

• Failing to understand and manage this new organization dynamic.

• Failure to explicitly define boundaries, with clearly defined roles and responsibilities.  Never outsource one piece at a time without a master plan.

• Outsourcing imposes discipline on your organization. Adapting to the rigorous processes required by an outsourcer may be difficult in some corporate cultures.

• New laws will essentially make security breaches at your outsourcer equivalent to security breaches at your own company.

Standard Conflict Management Practices and Tools

Outsourcing customers and providers usually enter into agreements with optimistic intentions and expectations.  Customer executives look forward to quality service, new thinking, extraordinary responsiveness, and a vendor that shows both a partner-like caring about the customer’s success and an intuitive understanding of the business.  Making outsourcing relationships work takes a lot more than good faith and committed people, and too few such arrangements actually come anywhere near reaching their desired goals.  Even with the best of intentions, relationships can end up in with diminishing returns for both parties.

Once in this downward spiral, customers and vendors are headed down the spiral to failure.  Both seem to get stuck in negative perceptions and behaviors.Technorati