Thursday, September 23, 2004

Reports from the Sarbanes-Oxley Front Lines

"Our auditors appear to be on the extreme side. Effective September 20, DBAs aren't allowed to hold administration rights in production because we're also considered developers. If a DBA needs access to the production environment, they have to wait for the Help desk to generate a work order, then request the ID from the network administrators (hopefully they're not busy at 2 a.m. when a job fails). And then there's all the logging we have to do now. At this point, we have over 20 logs that must be checked and acknowledged daily; by month end, it's likely to exceed 50. The joke around here is that we are going to have to start a new department with the sole purpose of reviewing the logs each day. The 'separation of duties' isn't a bad thing if you're fortunate to have a large IT department. But with seven people supporting offices in six states, there aren't enough heads for all the new hats."

The Sarbanes-Oxley auditors for this reader's firm have decided that they simply won't let production DBAs have the sa password. I wish this was a crazy, silly, extreme example, but I suspect that Dilbertian episodes like this one will become more common as more companies begin comprehensive Sarbanes-Oxley compliance activities. Another reader shared this scenario:

"We were just wrung through the Sarbanes-Oxley wringer here. And in my opinion, the effort was a total waste of time. The auditors didn't know what they were supposed to do, and they missed a lot of things that would have benefited from a closer audit scrutiny. Important concerns were either given a cursory look or totally ignored, while auditors focused on 'important' financial bottom-line stuff like "How often do you change passwords?" and "Where do you store your backup drives?" Those are certainly valid IT audit concerns, but I kept asking them "How does this affect our corporate financial statements?" It seems to me that auditors with lots of axes to grind went way overboard in using Sarbanes-Oxley as a big stick to get their way on certain things."

Reports from the Sarbanes-Oxley Front Lines

Send to a friend:

0 Comments: