How To Get Started with your IT Compliance Efforts for SOX

There’s no question about it. For many of you top executives in the corporate world, all roads leading to a brighter future have to go through SOX compliance. And because the business processes that contribute to financial reporting (the crux of the Sarbanes-Oxley Act) are now highly reliant on IT systems, it is important to focus a good part of your attention there.

It is a long and arduous path to IT compliance, so if you don’t want your company to fall by the wayside due to inefficient utilisation of resources, it is important to set out with a plan on hand. What we have here are some vital information that will guide you in putting together a sound plan for SOX compliance of your company?s IT systems.

Why focus on IT systems for SOX compliance?

We’ll get to that. But first, let’s take up the specific portions of the Sarbanes-Oxley Act that affect information technology. These portions can be found in Section 302 and Section 404 of the act.

In simplified form, Section 302 grants the SEC (Securities and Exchange Commission) authority to come up with rules requiring you, CEOs and CFOs, to certify in each annual or quarterly financial report the following:

  • that you have reviewed the report;
  • that based on your knowledge, the report does not contain anything or leave out anything that would render it misleading;
  • that based on your knowledge, all financial information in the report fairly represent the financial conditions of the company;
  • that you are responsible for establishing internal controls over financial reporting; and
  • that you have assessed the effectiveness of the internal controls.

Similarly, Section 404, stated in simplified form, allows the SEC to come up with rules requiring you, CEOs and CFOs, to add an internal control report to each annual financial report stating that you are responsible for establishing internal controls over financial reporting.

You are also required to assess the effectiveness of those controls and to have a public accounting firm to attest to your assessment based upon standards adopted by the Public Company Accounting Oversight Board (PCAOB).

While there is no mention of IT systems, IT systems now play a significant role in financial reporting. Practically all of the data you need for your financial reports are stored, retrieved and processed on IT systems, so you really have to include them in your SOX compliance initiatives and establish controls on them.

Now that that’s settled, your next question could very well be: How do you know what controls to install and whether those controls are already sufficient to achieve compliance?

Finding a suitable guide for IT compliance

The two bodies responsible for setting rules and standards dealing with SOX, SEC and PCAOB, point to a well-established control framework for guidance – COSO. This framework was drafted by the Committee of Sponsoring Organisations of the Treadway Commission (COSO) and is the most widely accepted control framework in the business world.

However, while COSO is a tested and proven framework, it is more suitable for general controls. What we recommend is a widely-used control framework that aligns well with COSO but also caters to the more technical features and issues that come with IT systems.

Taking into consideration those qualifiers, we recommend COBIT. COBIT features a well thought out collection of IT-related control objectives grouped into four domains: Plan and Organise (PO), Acquire and Implement (AI), Deliver and Support (DS), and Monitor and Evaluate (ME). The document also includes maturity models, performance goals and metrics, and activity goals.

A few examples of COBIt’s detailed control objectives are:

DS4.2 – IT Continuity Plans
DS4.9 – Offsite Backup Storage
DS5.4 – User Account Management
DS5.8 – Cryptographic Key Management
DS5.10 – Network Security
DS5.11 – Exchange of Sensitive Data

By those titles alone, you can see that the framework is specifically designed for IT. But the document is quite extensive and, chances are, you won’t need all of the items detailed there. Furthermore, don’t expect COBIT to specify a control solution controls for every control objective. For example, throughout the control objective DS4 (Ensure Continuous Service), you won’t find any mention of virtualisation, which is common in any modern business continuity solution.

Basically, COBIT will tell you what you need to attain in order to achieve effective governance, management and control, but you’ll have to pick the solution best suited to reach that level of attainment.

Articles highly relevant to the one you just read:

Month End Accounting The Way It Should Be Today
Spreadsheet Woes ? Burden in SOX Compliance and Other Regulations
Spreadsheet Woes ? Limited Features For Easy Adoption of a Control Framework
How Internal Auditors Can Win The War Against Spreadsheet Fraud

Check our similar posts

Sources of Carbon Emissions

Exchange of carbon dioxide among the atmosphere, land surface and oceans is performed by humans, animals, plants and even microorganisms. With this, they are the ones responsible for both producing and absorbing carbon in the environment. Nature?s cycle of CO2 emission and removal was once balanced, however, the Industrial Revolution began and the carbon cycle started to go wrong. The fact is that human activities substantially contributed to the addition of CO2 in the atmosphere.

According to statistics gathered by the Department of Energy and Climate Change, carbon dioxide comprises 82% of UK?s greenhouse gas emissions in 2012. This makes carbon dioxide the main greenhouse gas contributing to the pollution and subsequent climate change in UK.

Types of Carbon Emissions

There are two types of carbon emissions ? direct and indirect. It is easier to measure the direct emissions of carbon dioxide, which includes the electricity and gas people use in their homes, the petrol burned in cars, distance of flights taken and other carbon emissions people are personally responsible for. Various tools are already available to measure direct emissions each day.

Indirect emissions, on the other hand, include the processes involved in manufacturing food and products and transporting them to users? doors. It is a bit difficult to accurately measure the amount of indirect emission.

Sources of Carbon Emissions

The sources of carbon emissions refer to the sectors of end-users that directly emit them. They include the energy, transport, business, residential, agriculture, waste management, industrial processes and public sectors. Let’s learn how these sources contribute carbon emissions to the environment.

Energy Supply

The power stations that burn coal, oil or gas to generate electricity hold the largest portion of the total carbon emissions. The carbon dioxide is emitted from boilers at the bottom of the chimney. The electricity, produced from the fossil fuel combustion, emits carbon as it is supplied to homes, commercial establishments and other energy users.

Transport

The second largest carbon-emitting source is the transport sector. This results from the fuels burned in diesel and petrol to propel cars, railways, shipping vehicles, aircraft support vehicles and aviation, transporting people and products from one place to another. The longer the distance travelled, the more fuel is used and the more carbon is emitted.

Business

This comprises carbon emissions from combustion in the industrial and commercial sectors, off-road machinery, air conditioning and refrigeration.

Residential

Heating houses and using electricity in the house, produce carbon dioxide. The same holds true to cooking and using garden machinery at home.

Agriculture

The agricultural sector also produces carbon dioxide from soils, livestock, immovable combustion sources and other machinery associated with agricultural activities.

Waste Management

Disposing of wastes to landfill sites, burning them and treating waste water also emit carbon dioxide and contributes to global warming.

Industrial Processes

The factories that manufacture and process products and food also release CO2 , especially those factories that manufacture steel and iron.

Public

Public sector buildings that generate power from fuel combustion also add to the list of carbon emission sources, from heating to other public energy needs.

Everybody needs energy and people burn fossil fuels to create it. Knowing how our energy use affects the environment, as a whole, enables us to take a step ahead towards achieving better climate.

Contact Us

  • (+353)(0)1-443-3807 – IRL
  • (+44)(0)20-7193-9751 – UK
Without Desktop Virtualisation, you can’t attain True Business Continuity

Even if you’ve invested on virtualisation, off-site backup, redundancy, data replication, and other related technologies, I?m willing to bet your BC/DR program still lacks an important ingredient. I bet you’ve forgotten about your end users and their desktops.

Picture this. A major disaster strikes your city and brings your entire main site down. No problem. You’ve got all your data backed up on another site. You just need to connect to it and voila! you’ll be back up and running in no time.

Really?

Do you have PCs ready for your employees to use? Do those machines already have the necessary applications for working on your data? If you still have to install them, then that’s going to take a lot of precious time. When your users get a hold of those machines, will they be facing exactly the same interface that they’ve been used to?

If not, more time will be wasted as they try to familiarise themselves. By the time you’re able to declare ?business as usual?, you’ll have lost customer confidence (or even customers themselves), missed business opportunities, and dropped potential earnings.

That’s not going to happen with desktop virtualisation.

The beauty of?virtualisation

Virtualisation in general is a vital component in modern Business Continuity/Disaster Recovery strategies. For instance, by creating multiple copies of virtualised disks and implementing disk redundancy, your operations can continue even if a disk breaks down. Better yet, if you put copies on separate physical servers, then you can likewise continue even if a physical server breaks down.

You can take an even greater step by placing copies of those disks on an entirely separate geographical location so that if a disaster brings your entire main site down, you can still gain access to your data from the other site.

Because you’re essentially just dealing with files and not physical hardware, virtualisation makes the implementation of redundancy less costly, less tedious, greener, and more effective.

But virtualisation, when used for BC/DR, is mostly focused on the server side. As we’ve pointed out earlier in the article, server side BC/DR efforts are not enough. A significant share of business operations are also dependent on the client side.

Desktop virtualisation (DV) is very similar to server virtualisation. It comes with nearly the same kind of benefits too. That means, a virtualised desktop can be copied just like ordinary files. If you have a copy of a desktop, then you can easily use that if the active copy is destroyed.

In fact, if the PC on which the desktop is running becomes incapacitated, you can simply move to another machine, stream or install a copy of the virtualised desktop there, and get back into the action right away. If all your PCs are incapacitated after a disaster, rapid provisioning of your desktops will keep customers and stakeholders from waiting.

In addition to that, DV will enable your user interface to look like the one you had on your previous PC. This particular feature is actually very important to end users. You see, users normally have their own way of organising things on their desktops. The moment you put them in front of a desktop not their own, even if it has the same OS and the same set of applications, they?ll feel disoriented and won’t be able to perform optimally.

Contact Us

  • (+353)(0)1-443-3807 – IRL
  • (+44)(0)20-7193-9751 – UK
Matrix Management: Benefits and Pitfalls

Matrix management brings together managers and employees from different departments to collaborate with each other towards the accomplishment of the organizational goals. As much as it is beneficial, matrix management also has limitations. Hence, companies should understand its benefits and pitfalls before implementing this management technique.

Benefits

The following are some of the advantages of matrix management:

Effective Communication of Information

Because of the hybrid nature of the matrix structure, it enables different departments to closely work together and communicate frequently in order to solve project issues. This leads to a proficient information exchange among leaders and subordinates. Consequently, it results to developed strategies, enhanced performance and quick productivity.

Efficient Use of Resources

Resources can be used efficiently in the organisation since it can be shared among functions and projects. As the communication line is more open, the valuable knowledge and highly skilled resources are easily distributed within the organisation.

Increased Motivation

The matrix structure promotes democracy. And with the employees working on a team, they are motivated to perform their duties better. The opinions and expertise of the employees are brought to the table and considered by the managers before they make decisions. This leads to employee satisfaction, empowerment and improved performance.

Flexibility

Since the employees communicate with each other more frequently, decision making becomes speedy and response is adaptive. They can easily adjust with diverse situations that the company encounters.

Skills Development

Matrix employees are pooled out for work assignments, even to projects that are not necessarily in line with their skill background. With this approach to management, employees have the chance to widen their skills and expertise.

Discipline Retention

One significant advantage of matrix management is that it enables the employees to maintain their skills in functional areas while working with multidisciplinary projects. Once the project is completed and the team wraps up, the members remain sharp in their discipline technically and return to their home functions.

Pitfalls

Here are some disadvantages of matrix management:

Power Struggle

In the matrix structure, there is always tension between the functional and project manager. Although their intent is polite, their conflicting demands and competition for control over the same resources make it more difficult.

Internal Complexity

Having more than one manager, the employees might become confused to who their immediate leader is. The dual authority can lead to internal complexity and possible communication problems. Worst, employee dissatisfaction and high employee turnover.

Heightened Conflict

In any given situation where people and resources are shared across projects, there would always be competition and conflict. When these issues are prolonged, conflicts will heightened and will lead to more internal problems.

Increased Stress

For the employees, being part of a matrix structure can be stressful. Their commitment is divided among the projects and their relationship with multiple managers requires various adjustments. Increased stress can negatively affect their performance in the long run.

Excessive Overhead Expenses

Overhead administrative costs, such as salaries, increase in a matrix structure. More expenses, more burden to the organisation. This is a challenge to matrix management that leaders should consider carefully.

These are just some of the advantages and disadvantages of matrix management. The list could go on, depending on the unique circumstances that organisations have. The key is that when you decide to implement matrix management, you should recognise how to take full advantage of its benefits and understand how to lessen, if not eradicate, the pitfalls of this approach to management.

Ready to work with Denizon?

Contact Us Today