IPLocks SOX Compliance Solutions
Control, Integrity, Assurance - Cost-Efficient & Auditor-Friendly
The Sarbanes-Oxley Act of 2002 (SOX) was passed as a direct result of corporate fraud and fiscal mismanagement at major companies such as Enron and WorldCom. Significant internal control failures associated with financial statements resulted in billions of dollars in corporate and investor losses.
As a result, SOX and other compliance regulations have emphasized the importance of securing and auditing financial data. Accounting and financial software packages rely on databases such as Oracle and DB2 to store data, which implies tighter internal controls around those databases.
There are two sections of the SOX legislation that garner most of the attention:
- Section 302 Corporate Responsibility for Financial Reports
- Requires management review and sign-off on SOX controls
- Contains penalty clauses, including fines and imprisonment, for failure to comply with SOX regulations
- Section 404 Management Assessment of Internal Controls
- Outlines areas for which controls should be implemented
- Requires independent audit attestation to SOX controls
SOX legislation also establishes the Public Company Accounting Oversight Board (PCAOB) that publishes standards related to SOX controls and assessing SOX compliance. The PCAOB references IT frameworks such as COBIT when addressing the IT aspects of SOX compliance.
How IPLocks Applies to SOX
While SOX is intended to encourage companies to follow best practices, find financial inaccuracies, and deter fraud, the expenses for SOX compliance are, unfortunately, far greater than anticipated. IPLocks automates many SOX controls, as preferred by the PCAOB, and increases the efficiency of compliance efforts. The following table shows how IPLocks addresses key issues with SOX compliance:
- Control Integrity
- Separates SOX controls from DBAs, decreasing likelihood of control integrity issues
- Automatic, continuous controls on financial data ensure auditing is complete and accurate
- Integration with Change Management and Security infrastructure products enables preventive controls as preferred by auditors.
- Difficulty Implementing Controls
- Heterogeneous database support provides consistent controls across the organization
- Pre-packaged IT Internal Controls address fundamental SOX requirements; often no need to customize
- Auditor-designed reports meet PCAOB standards for controls; makes auditors happy
- Excessive SOX Costs
- Automated controls are preferred by PCAOB and auditors, require less testing by external auditors saving time and money
- Pre-packaged policies and reports removes the burden from DBAs; make compliance a process, not a project
- Easy-to-Implement controls piggyback on existing infrastructure, don’t require application changes or add additional points of failure
