How COBIT helps you achieve SOX Compliance

First released way back in 1996, COBIT has already been around for quite a while. One reason why it never took off was because companies were never compelled to use it ? until now. Today, many CEOs and CIOs are finding it to be a vital tool for achieving SOX compliance in IT.

Thanks to SOX, COBIT (Control Objectives for Information and related Technology) is now one of the most widely accepted source of guidance among companies who have IT integrated with their accounting/financial systems. It has also gained general acceptability with third parties and regulators. But how did this happen?

Role of control frameworks in SOX compliance

You see, the Sarbanes-Oxley Act, despite having clearly manifested the urgency of establishing effective internal controls, does not provide a road map for you to follow nor does it specify a yardstick to help you determine whether an acceptable mileage in the right direction has already been achieved.

In other words, if you were a CIO and you wanted to find guidance on what steps you had to take to achieve compliance, you wouldn’t be able to find the answers in the legislation itself.

That can be a big problem. Two of your main SOX compliance obligations as a CEO or CIO is to assume responsibility in establishing internal controls over financial reporting and to certify their effectiveness. After that, the external auditors are supposed to attest to your assertions. Obviously, there has to be a well-defined basis before you can make such assertions and auditors can attest to anything.

In the language of auditors, this ?well-defined basis? is known as a control framework. Simply put, once you certify the presence of adequate internal controls in your organisation, the external auditor will ask, ?What control framework did you use??

Knowing what control framework you employed will help external auditors determine how to proceed with their evaluations and tests. For your part, a control framework can serve as a guide to help you work towards specific objectives for achieving compliance. Both of you can use it as a common reference point before drawing any conclusions regarding your controls.

But there are many control frameworks out there. What should you use?

How SOX, COSO, and COBIT fit together

Fortunately, despite SOX?s silence regarding control frameworks, you aren’t left entirely to your own devices. You could actually take a hint from the SEC and PCAOB, two of the lead organisations responsible for implementing SOX. SEC and PCAOB point to the adoption of any widely accepted control framework.

In this regard, they both highly endorse COSO, a well-established internal control framework formulated by the Committee of Sponsoring Organisations of the Treadway Commission (COSO). Now, I must tell you, if you’re looking specifically for instructions pertaining to IT controls, you won’t find those in COSO either.

Although COSO is the most established control framework for enterprise governance and risk management you’ll ever find (and in fact, it’s what we recommend for your general accounting processes), it lacks many IT-related details. What is therefore needed for your IT processes is a framework that, in addition to being highly aligned with COSO, also provides more detailed considerations for IT.

This is where COBIT fits the bill.

How COBIT can contribute to your regulatory compliance endeavors

COBIT builds upon and adheres with COSO while providing a finer grain of detail focused on IT. You can even find a mapping between COBIT IT processes and COSO components within the COBIT document itself.

Designed with regulatory compliance in mind, COBIT lays down a clear path for developing policies and good practice for IT control, thus enabling you to bridge the gap between control requirements, technical issues, and business risks.

Some of the components you’ll find in COBIT include:

IT control objectives

These are statements defining specific desired results that, as a whole, characterise a well-managed IT process. They come in two forms for each COBIT-defined IT process: a high-level control objective and a number of detailed control objectives. These objectives will enable you to have a sense of direction by telling you exactly what you need to aim for.

Maturity models

These are used as benchmarks that give you a relative measurement stating where your level of management or control over an IT process or high-level control objective stands. It serves as a basis for setting as-is and to-be positions and enables support for gap analysis, which determines what needs to be done to achieve a chosen level. Basically, if a control objective points you to a direction, then its corresponding maturity model tells you how far in that direction you’ve gone.

RACI charts

These charts tell you who (e.g. CEO, CFO, Head of Operations, Head of IT Administration) should be Responsible, Accountable, Consulted, and Informed for each activity.

Goals and Metrics

These are sets of goals along with the corresponding metrics that allow you to measure against those goals. Goals and metrics are defined in three levels: IT goals and metrics, which define what business expects from IT; process goals and metrics, which define what the IT process should deliver to support It’s objectives; and activity goals and metrics, which measure how well the process is performing.

In addition to those, you’ll also find mappings of each process to the information criteria involved, IT resources that need to be leveraged, and the governance focus areas that are affected.

Everything is presented in a logical and manageable structure, so that you can easily draw connections between IT processes and business goals, which will in turn help you decide what appropriate governance and control is needed. Ultimately, COBIT can equip you with the right tools to maintain a cost-benefit balance as you work towards achieving SOX compliance.

Check our similar posts

Finding the Best Structure for Your Enterprise Development Team

An enterprise development team is a small group of dedicated specialists. They may focus on a new business project such as an IoT solution. Members of microteams cooperate with ideas while functioning semi-independently. These self-managing specialists are scarce in the job market. Thus, they are a relatively expensive resource and we must optimise their role.

Organisation?Size and Enterprise Development Team Structure

Organisation structure depends on the size of the business and the industry in which it functions. An enterprise development team for a micro business may be a few freelancers burning candles at both ends. While a large corporate may have a herd of full-timers with their own building. Most IoT solutions are born out of the efforts of microteams.

In this regard, Bill Gates and Mark Zuckerberg blazed the trail with Microsoft and Facebook. They were both college students at the time, and both abandoned their business studies to follow their dreams. There is a strong case for liberating developers from top-down structures, and keeping management and initiative at arm?s length.

The Case for Separating Microteams from the?Organisation

Microsoft Corporation went on to become a massive corporate, with 114,000 employees, and its founder Bill Gates arguably one of the richest people in the world. Yet even it admits there are limitations to size. In Chapter 2 of its Visual Studio 6.0 program it says,

‘today’s component-based enterprise applications are different from traditional business applications in many ways. To build them successfully, you need not only new programming tools and architectures, but also new development and project management strategies.?

Microsoft goes on to confirm that traditional, top-down structures are inappropriate for component-based systems such as IoT solutions. We have moved on from ?monolithic, self-contained, standalone systems,? it says, ?where these worked relatively well.?

Microsoft’s model for enterprise development teams envisages individual members dedicated to one or more specific roles as follows:

  • Product Manager ? owns the vision statement and communicates progress
  • Program Manager ? owns the application specification and coordinates
  • Developer ? delivers a functional, fully-complying solution to specification
  • Quality Assurer ? verifies that the design complies with the specification
  • User Educator ? develops and publishes online and printed documentation
  • Logistics Planner ? ensures smooth rollout and deployment of the solution

Three Broad Structures for Microteams working on IoT Solutions

The organisation structure of an enterprise development team should also mirror the size of the business, and the industry in which it functions. While a large one may manage small microteams of employee specialists successfully, it will have to ring-fence them to preserve them from bureaucratic influence. A medium-size organisation may call in a ?big six? consultancy on a project basis. However, an independently sourced micro-team is the solution for a small business with say up to 100 employees.

The Case for Freelancing Individuals versus Functional Microteams

While it may be doable to source a virtual enterprise development team on a contracting portal, a fair amount of management input may be necessary before they weld into a well-oiled team. Remember, members of a micro-team must cooperate with ideas while functioning semi-independently. The spirit of cooperation takes time to incubate, and then grow.

This is the argument, briefly, for outsourcing your IoT project, and bringing in a professional, fully integrated micro-team to do the job quickly, and effectively. We can lay on whatever combination you require of project managers, program managers, developers, quality assurers, user educators, and logistic planners. We will manage the micro-team, the process, and the success of the project on your behalf while you get on running your business, which is what you do best.

Contact Us

  • (+353)(0)1-443-3807 – IRL
  • (+44)(0)20-7193-9751 – UK
How Energy Management Software Benefits Your Business

We’re in an era of price volatility in gas and electricity prices, coupled with greater scrutiny on the environmental impact of businesses in their day-to-day operations. According to the Department of Energy & Climate Change, the average SME can slash its energy bill by 18-25% simply by installing energy efficiency solutions in their facility. 

Are you looking to improve energy use in your business? Prevent wastage, track consumption, identify opportunities to save on energy and reduce your carbon footprint while at it? It can be a daunting process to do it all manually. Taking those meter readings, preparing spreadsheets and combing through quotes and energy bills to validate them – this is not something you should be enduring in this day and age. Not when there are dedicated systems built for the task. That’s where Energy Management Software (EMS) comes in. 

Importance Of Energy Management Software

Wasted energy = Wasted money

Failing to improve energy efficiency is costing SMEs loads of funds, with it coming to between £5,801 and £12,109 of missed annual savings for individual businesses. These are 18% – 24% of their energy costs. Where do you stand?

Take timers and thermostats for instance. When not properly set and controlled, or even simply forgetting to turn them down when not in the room, it can easily lead to unnecessary costs. How often do your staff forget to turn off the air conditioning when they leave the meeting rooms? Do you account for weekends or bank holidays when setting the controls of the AC? Mistakes like turning the temperature high on the thermostat to “quickly warm the room” are common, yet heating costs go up by about 8% with every 1°C rise.

There are installations that you can make to minimize wastage. For example, the Chinese Contemporary Arts Centre in Manchester is able to save £4,363 annually just by having a £100 timer installed to its heating system. 

Some energy saving measures won’t even cost you a penny. For instance, did you know that you can save up to 30% of your heating costs simply by preventing cold air from entering the building? This means not keeping the doors just open for convenience. So how can you find points of weakness and areas of improvements in your facility? Install an EMS. 

While businesses vary from one industry to the next, energy management basically boils down to:

  • Metering systems where the consumption is recorded
  • Determining how much energy can be saved by identifying opportunities for this
  • Implementing policies and changing existing systems to take advantage of these opportunities
  • Tracking progress after the improvements have been made

 

Benefits Of EMS For Your Business

Data Acquisition – Where accuracy and reliability matters

Energy data comes from different angles and formats. From the building automation systems and IoT devices that have been set up, bills sent in by the utility company to the spreadsheets needed to analyse them – what if you had it all from one point of reference? The EMS gives you a “bird’s eye view” of all your energy data from one interface. It collects the data from any system – and being cloud-based, is accessible from anywhere in the world. 

The ecoVaro data loggers can be connected with the Wi-Fi network of the facility or function independently, depending on your specific requirements. They monitor readings 24/7, retaining the data even when they have been powered off. The end-to-end encryption assures you of the security of the information that is being obtained. 

Integrating the EMS into the existing systems will simplify the data collection process, and even for the cases where there isn’t a direct method transferring the data into the system, the setup wizards that come with the EMS allow you to prepare the required data and import it. 

Data Analysis: From consumption, energy leaks to areas of improvement

The first step is accurately collecting the data. The next step is making sense of it. The analysis modules with the EMS allow you to monitor the energy consumption of the facility in real-time. 

The energy data is displayed in engaging graphics that are easy to understand at a glance. The dashboard setup, with its customised layout, enables you to monitor the performance of the specific information you want, toggling through usage and savings data, to the meters and sites that are being tracked. With the ecoVaro Energy Management Software, you get Consumption Charts, Regression Charts, Cusum Charts and Heatmaps right to the submeter level. This information can be broken down into 15-minute durations, with the daily, weekly and monthly consumption reports. 

Getting everyone on board

Making changes to company-wide energy policies needs to have the different parties on board – from the energy manager in charge of crunching the numbers and presenting the information, the CFO of the business, the staff running day-to-day operations, all through to plant operators for those in industries. An easy mode of communication is needed, that will be understood and availed in reports that can be shared with the relevant parties in the organization. The graphical displays that come with the EMS enable actionable information to be displayed in a simplified manner – that way all members of the business or organization will be able to comprehend it. 

Meet your Energy Goals

The baseline that is created in the EMS is used as a standard when assessing the impact of future changes to the energy consumption. Using the information that has been obtained, the management can set up energy saving policies and implement changes, and track KPIs (key performance indicators) along the way. For instance, the market research company DJS Research installed a timer switch that turns off their two water coolers when they aren’t in use. This action saves them £144 annually, and had already paid for itself within 35 days.   

You will be in a position to assess the actions that provide your business with the best ROI over time, monitoring the progress and verifying the savings from one central dashboard. Cutting costs here will enable you to divert the funds to other areas of your business, including promotions, marketing, and product development.

For businesses in the energy sector- including electric, oil and gas plants, they specifically need carbon emission reports, to pinpoint areas where the building’s energy efficiency can be improved. ecoVaro EMS allows you to set alarms and KPIs in the facility for issues to be identified and resolved immediately they crop up. 

Turn to ecoVaro

EMS systems are used across the board – from optimising energy use in hotel rooms and hospitals, mapping out usage patterns for those in the agriculture and supply chain niches, running facilities for utility providers, all through to increasing the efficiency of equipment operation for business in the food and beverage sector. Want to learn how you can cut down your energy bills and make your business more eco-friendly? EcoVaro’s team is ready to get you started.

How Volvo Dublin achieved Zero Landfill Status

The sprawling New River Valley Volvo plant in Dublin, Virginia slashed its electricity bill by 25% in a single year when it set its mind to this in 2009. It went on to become the first carbon-neutral factory in 2012 after replacing fossil energy with renewable power. Further efforts rewarded it with zero-landfill status in 2013. ecoVaro decided to investigate how it achieved this latest success.

Volvo Dublin?s anti-landfill project began when it identified, measured and evaluated all liquid and solid waste sources within the plant (i.e. before these left the works). This quantified data provided its environmental project team with a base from which to explore options for reusing, recycling and composting the discards.

Several decisions followed immediately. Volvo instructed its component suppliers to stop using cardboard boxes and foam rubber / Styrofoam as packaging, in favour of reusable shipping containers. This represented a collaborative saving that benefited both parties although this was just a forerunner of what followed.

Next, Volvo?s New River Valley truck assembly plant turned its attention to the paint shop. It developed methods to trap, reconstitute and reuse solvents that flushed paint lines, and recycle paint sludge to fire a cement kiln. The plant cafeteria did not escape attention either. The environment team made sure that all utensils, cups, containers and food waste generated were compostable at a facility on site.

The results of these simple, and in hindsight obvious decisions were remarkable. Every year since then Volvo has generated energy savings equivalent to 9,348 oil barrels or if you prefer 14,509 megawatts of electricity. Just imagine the benefits if every manufacturing facility did something similar everywhere around the world.

By 2012, the New River Valley Volvo Plant became the first U.S. facility to receive ISO 50001 energy-management status under a government-administered process. Further technology enhancements followed. These included solar hot water boilers and infrared heating throughout the 1.6 million square foot (148,644 square meter) plant, building automation systems that kept energy costs down, and listening to employees who were brim-full with good ideas.

The Volvo experience is by no means unique although it may have been ahead of the curve. General Motors has more than 106 landfill-free installations and Ford plans to reduce waste per vehicle by 40% between 2010 and 2016. These projects all began by measuring energy footprints throughout the process. ecoVaro provides a facility for you to do this too.

Contact Us

  • (+353)(0)1-443-3807 – IRL
  • (+44)(0)20-7193-9751 – UK

Ready to work with Denizon?

Contact Us Today