Operations Risk - Sarbanes-Oxley, How to Avoid Costly Mistakes

Forrester Research

A recent article in CIO magazine discusses recommended procedures for meeting Sarbanes-Oxley compliance to avoid high costs.

Forrester Research estimates that fewer than 1,000 companies nationwide actually bought Sarbanes-Oxley software in 2004 and CIO has found that a number of companies that did haven't yet deployed it since there was no time. Unless CIOs approach the second Sarbanes-Oxley IT audit differently from the first, chances are good that it will take even more time, cost even more money and cause even more pain.

In the rush to meet the audit deadline, many CIOs put more controls in place than they really needed. That resulted in a lot of unnecessary work, which may actually double this year as they try to prove that those controls are being used. So while last year CIOs had to assign someone to check an application audit log, this year, in order to pass the audit, they will need to demonstrate that the check was performed regularly—a documentation challenge fully on par with last year's effort to install the control. In other words, Sarbanes-Oxley compliance has to be treated as an ongoing process. And the only way to follow this new process without crippling the IT department will be to automate as many of these controls as possible.

See full Article.