Thursday, September 30, 2004

Thoughts from the Integration Consortium: Sarbanes-Oxley Act and IT: Why There is No "I" in "SOX Team"

Sarbanes-Oxley (SOX) compliance has become the number one issue facing CXO executives today. Compliance with the terms of the SEC's SOX Act of 2002 has become the number one pain point of most public organizations and boards of directors both in the U.S.A. and around the world. They are in a desperate race to ensure they have documented and tested a range of financial controls all to ensure the integrity of the financial number they make public at each year end and at each quarter. But the extensive and elaborate team of senior executives that meets once a week to discuss the progress of SOX compliance is often without a critical member of the team, the CTO or CIO. Information system executives are often left off the SOX compliance committees and teams simply because they are viewed as outside the realm of financial reporting.

Section 404 states in brief that executive managers and boards of directors of public organizations must acknowledge their responsibility for the financial controls within the organization and the accuracy of the financial information made public. Then they must provide an assessment of the effectiveness of these controls and have an auditor attest to this assessment. Section 409 stipulates that the same board and executives must disclose real-time information "concerning material changes in the financial condition or operations of the issuer including trends as the Commission determines necessary for the protection of investors and in the public interest." The ability to report real-time information and set controls to ensure the validity of financial information was thought by the SEC and the PCAOB to be fully within the realm of the financial professionals that posted the information. But they were wrong.

Thoughts from the Integration Consortium: Sarbanes-Oxley Act and IT: Why There is No "I" in "SOX Team"

Send to a friend:

0 Comments: