How To Get Started with your IT Compliance Efforts for SOX

There’s no question about it. For many of you top executives in the corporate world, all roads leading to a brighter future have to go through SOX compliance. And because the business processes that contribute to financial reporting (the crux of the Sarbanes-Oxley Act) are now highly reliant on IT systems, it is important to focus a good part of your attention there.

It is a long and arduous path to IT compliance, so if you don’t want your company to fall by the wayside due to inefficient utilisation of resources, it is important to set out with a plan on hand. What we have here are some vital information that will guide you in putting together a sound plan for SOX compliance of your company?s IT systems.

Why focus on IT systems for SOX compliance?

We’ll get to that. But first, let’s take up the specific portions of the Sarbanes-Oxley Act that affect information technology. These portions can be found in Section 302 and Section 404 of the act.

In simplified form, Section 302 grants the SEC (Securities and Exchange Commission) authority to come up with rules requiring you, CEOs and CFOs, to certify in each annual or quarterly financial report the following:

that you have reviewed the report;
that based on your knowledge, the report does not contain anything or leave out anything that would render it misleading;
that based on your knowledge, all financial information in the report fairly represent the financial conditions of the company;
that you are responsible for establishing internal controls over financial reporting; and
that you have assessed the effectiveness of the internal controls.

Similarly, Section 404, stated in simplified form, allows the SEC to come up with rules requiring you, CEOs and CFOs, to add an internal control report to each annual financial report stating that you are responsible for establishing internal controls over financial reporting.

You are also required to assess the effectiveness of those controls and to have a public accounting firm to attest to your assessment based upon standards adopted by the Public Company Accounting Oversight Board (PCAOB).

While there is no mention of IT systems, IT systems now play a significant role in financial reporting. Practically all of the data you need for your financial reports are stored, retrieved and processed on IT systems, so you really have to include them in your SOX compliance initiatives and establish controls on them.

Now that that’s settled, your next question could very well be: How do you know what controls to install and whether those controls are already sufficient to achieve compliance?

Finding a suitable guide for IT compliance

The two bodies responsible for setting rules and standards dealing with SOX, SEC and PCAOB, point to a well-established control framework for guidance – COSO. This framework was drafted by the Committee of Sponsoring Organisations of the Treadway Commission (COSO) and is the most widely accepted control framework in the business world.

However, while COSO is a tested and proven framework, it is more suitable for general controls. What we recommend is a widely-used control framework that aligns well with COSO but also caters to the more technical features and issues that come with IT systems.

Taking into consideration those qualifiers, we recommend COBIT. COBIT features a well thought out collection of IT-related control objectives grouped into four domains: Plan and Organise (PO), Acquire and Implement (AI), Deliver and Support (DS), and Monitor and Evaluate (ME). The document also includes maturity models, performance goals and metrics, and activity goals.

A few examples of COBIt’s detailed control objectives are:

DS4.2 – IT Continuity Plans
DS4.9 – Offsite Backup Storage
DS5.4 – User Account Management
DS5.8 – Cryptographic Key Management
DS5.10 – Network Security
DS5.11 – Exchange of Sensitive Data

By those titles alone, you can see that the framework is specifically designed for IT. But the document is quite extensive and, chances are, you won’t need all of the items detailed there. Furthermore, don’t expect COBIT to specify a control solution controls for every control objective. For example, throughout the control objective DS4 (Ensure Continuous Service), you won’t find any mention of virtualisation, which is common in any modern business continuity solution.

Basically, COBIT will tell you what you need to attain in order to achieve effective governance, management and control, but you’ll have to pick the solution best suited to reach that level of attainment.

Articles highly relevant to the one you just read:

Month End Accounting The Way It Should Be Today
Spreadsheet Woes ? Burden in SOX Compliance and Other Regulations
Spreadsheet Woes ? Limited Features For Easy Adoption of a Control Framework
How Internal Auditors Can Win The War Against Spreadsheet Fraud

Check our similar posts

Importance of Field Service Management Software for Mobile Working

Technology has been evolving at a fast pace. Changes are also happening simultaneously within different industries. Making a great difference in the business world right now is the trend of mobile working.

Thanks to platforms and tools, working while on the go is now easier and more streamlined. The field service industry also benefits from these technological advances.

Mobile technicians can now give excellent performance and do their job efficiently with no hands-on management needed.

Keep in mind that field service management is no joke. So, to achieve a smooth business and mobile worker management, you’ll need to invest in good mobile service management software.

But First, what is Mobile Working?

Mobile working is a method of working that is not tied to a single physical location.

It isn’t just about checking your emails on your phone or ringing your colleagues via Bluetooth while driving your car to the next appointment. It’s so much more intricate than that.

Effective mobile working means you’re mobilising your workers. Field technicians should have everything they need to complete their day to day work. You’re giving them their entire office in the form of a mobile device.

Mobile working, via a handheld device, allows field technicians to do the following:
● Access and input information about a work order
● Collaborate on projects
● Stay in touch with colleagues, clients and management
● Utilize effectively the different software features

Your field workers should have the support of a dynamic management tool that ensures they are sent to the job that utilises their skills effectively and efficiently.

That’s where a good field service management software shows its importance.

The Role of a Field Service Management Software

Your mobile workforce is scattered across various physical locations. You’ll need to connect with them and simultaneously manage your field service business.

Thanks to the increasing connectivity and improvement of technologies for this purpose, mobile workers can easily input and access any work order details via your chosen field service management software.

What Makes a Good Field Service Management Software?

There are 3 main points to consider when investing in a good mobile workforce management software:

1. It’s simple and familiar to use. Like we mentioned before, be sure to mobilise your field technicians – not the back-office system. Make sure your chosen app or software has a simple user interface so your workers can be on-the-go easily.

2. It works offline. Rural areas and highways can have poor connectivity. Sometimes agents will need to work in areas that have little to no network coverage or are deep down working in tunnels or around heavy machines and turbines. You don’t want your field technicians unable to complete work due to connectivity issues. Make sure to choose software that can function on their device while offline.

3. It’s flexible (and maintainable). Your field service management of choice should have real-time visibility. Flexible and improved visibility for a field worker means that they can do their best in any task. They can share or get critical information about orders and customers. This drastically improves job completion rates and customer satisfaction.

Importance of Field Service Management Software to Mobile Working

Utilize the technology that is available to you. Your mobile workforce should have the right tools so they can make sure to do their fieldwork efficiently without worrying about tedious administrative work. Any back-office task can be done quickly through a field service management software.

And that’s the most important role of a great mobile service management app — effective mobile worker efficiency.

Benefits of a Field Service Management Software to Mobile Working

● Additional revenue: By simplifying the administrative work, your field technician can even double the work order in their daily shift, meaning more profit for the business.

● Cost-cutting: The cloud-based nature of a field service management software means that your business can reduce the cost of on-site IT.
Your mobile workforce can operate from wherever they have an online connection, meaning less reliance on offices and building costs.

● Boosts overall efficiency: A mobile workforce management software allows you as a manager to monitor in real-time where they are and what they are doing. It means that problems can be identified and dealt with immediately.
Your field technician, in turn, becomes more efficient because the technology allows them a quicker response, instead of taking too long finishing administrative tasks.

Invest in a great field service management software. Check out FieldElite and see how they can help you with the following mobile working features:
• Accepts jobs in the field
• Automate appointment scheduling
• Manage scheduled jobs
• Get real-time visibility into all operations
• Have a clear and easy viewing of job locations
• Resolve field service calls faster
• Enable mobile workers to get the job done right
• Keep customers updated at every step
• Create quotations and accept payments
• Analyse efficient reports from field technicians

Disaster Recovery

Because information technology is now integrated in most businesses, a business continuity plan (BCP) cannot be complete without a corresponding disaster recovery plan (DRP). While a BCP encompasses everything needed – personnel, facilities, communications, processes and IT infrastructure – for a continuous delivery of products and services, a DRP is more focused on the IT aspects of the plan.

If you’re still not sure how big an impact loss of data can have, it’s time you pondered on the survival statistics of companies that incurred data losses after getting hit by a major disaster: 46% never recovered and 51% eventually folded after only two years.

Realising how damaging data loss can be to their entire business, most large enterprises allocate no less than 2% of their IT budget to disaster recovery planning. Those with more sensitive data apportion twice more than that.

A sound disaster recovery plan is hinged on the principles of business continuity. As such, our DRP (Disaster Recovery Plan) blueprints are aimed at getting your IT system up and running in no time. Here’s what we can do for you:

Since the number one turn-off against BCPs and DRPs are their price tags, we’ll make a thorough and realistic assessment of possible risks to determine what specific methods need to be applied to your organisation and make sure you don’t spend more than you should.
Provide an option for virtualisation to enjoy substantial savings on disaster recovery costs.
Provide various backup options and suggest schedules and practices most suitable for your daily transactions.
Offer data replication to help you achieve business continuity with the shortest allowable downtime.
Refer to your overall BCP to determine your organisation’s critical functions, services, and products as well as their respective priority rankings to know what corresponding IT processes need to be in place first.
Implement IT Security to your system to reduce the risks associated with malware and hackers.
Introduce best practices to make future disaster recovery efforts as seamless as possible.

We can also assist you with the following:

Shared Services ? Are They A Good Idea

Things happen fast in business and we need to stay on top. It does not seem long ago that some enterprises were still hands-on traders or artisans with a few youngsters to help out. People like that did not do admin and their accounting was a matter of making sure there was enough money in the jar.

When Wal-Mart’s Sam Walton took over his first shop in 1945 things had moved on from there, although he did still deal directly with his customers. When he died his legacy was 380,000 jobs, and a business larger than most economies. So there?s plenty we can learn from how he grew his business.

One of Sam?s secrets was his capacity to centralise what needed gathering together, while empowering store managers to think independently when it came to local conditions. His regional warehouses had individual outlets clustered around them within one day?s drive each. This shared service eliminated 90% of safety stock and released capital for expansion.

Wal-Mart took sharing services a step further in February 2006, when it centralised accounts payable, accounts receivable, general accounting and human resources administration at Wal-Mart Stores and Sam?s Clubs in the U.S. and Puerto Rico. The objective was to bring costs down, while allowing local managers more time to focus on their business plans and other initiatives. As a further spin-off, Wal-Mart was able to integrate its data on a single SAP platform and eliminate significant roadblocks.

This is an excellent example of sharing services by creating own centres of excellence.? Of course, this is not the only business possibility. Other corporates have successfully completely outsourced their support activities, and Wal-Mart has no doubt had a variety of similar offers too. But, is the Wal-Mart picture entirely rosy, or is there a catch?

The Association of Chartered Certified Accountants has indicated that top talent may be the loser globally. This is because the Wal-Mart model removes many challenges through standardisation, and offers less scope for internal promotion as a result. Language and cultural differences may also have a long-term detrimental effect on the way the departments work well together.

Local outsourcing ? this is the business model where several firms engage a shared service provider independently- may hence prove to be a more malleable option for smaller companies. It often makes more sense to hunt down made-to-order services. Offerings such as the professional support we offer on this site.