SOX????

1
??

• ??
• SOX????
• SOX??????????
• SOX?IT??
• SOX?????

2
??

• ??
• ??,??????????????????????,??????????????
• ??????????????????????????????????????????????????
  ?
• ??????,????????????????????????????
• 2002?6?,??????????-??????????,????????????????????
  ??????????????????,??????-?????????????1933????
  ?1934????????????,?????????????????????????????
  ???
• ??
• ??????,??????,???????
• ??????,???????
• ????????????????
• ?????????????????????????
• ??????????????????????????????????????

3
??

• ??
• SOX????
• SOX??????????
• SOX?IT??
• SOX?????

4
SOX????

• ????????????????(PCAOB),????????????
• PCAOB????????,??SEC????
• ????????????????????PCAOB????,???PCAOB???????
• PCAOB????????????????????????

5
SOX????

• ???????????
• ????????????????????????????????????
• ????????????5??????
• ?????????????????????????????????????????,????????
  ??????????????

6
SOX????

• ???????????
• ????????????????????????
• ??????????????????SEC??????????????,?????????????
  ????????????????????????????????????????????
• ???????????????????,SEC???????????????????????????
  ??

7
SOX????

• ????????
• ???????????,????????????????????????????
• ??????????????????????????,???????????????????????
  ????

8
SOX????

• ????????????
• ????????????????25?????????????????????????500????
  2500????
• ????????????????????????3??????1??????5??2??

9
??

• ??
• SOX????
• SOX??????????
• SOX?IT??
• SOX?????

10
??????????

• ????????
• ?????????????????????????????
• ?????????
• ?????????????????????
• ?????????????????
• ????????
• ????????????????????
• ???????????
• ???????
• ???????????

11
?????????
Disclosure of material changes on a rapid and
current basis
Expanded representations by certifying officers
re disclosure controls
Section 409
Section 302
Section 404
Section 906
Focused representations by certifying officers
linked to criminal provisions of the Act
Assessment of the effectiveness of internal
controls over financial reporting with external
auditor attestation
12
SOX????????

• ?????????????????????
• ???????????????????????
• ??????????????????????????,?????????????????????

13
??

• ??
• SOX????
• SOX??????????
• SOX?IT??
• SOX?????

14
SOX????????

• ?302? ??????????
• ?????????????????/???????
• ?????????????
• ?????????????????????????????
• ?????????????,???????
• ?????????????????????????????????
• ?????????????
• ?404? ???????????
• ???????????????
• ?????????????????????????????
• ???????????????????????????(??COSO????)
• ????????????????????????

15
??????

• ????
• ????????,????????????????????????????????????????
  ????
• ????????
• ????????
• ???????

16
??????COSO
17
IT????????

• ????????????????????????????????????????,?????????
  ???????
• ??????IT???????????????????????
• ????????e????,??????????????
• ???IT???,????????????????,???????????IT??,???IT???
  ????????????????? 

18
????????IT??

• IT?????????????IT????????????,?????(????????)?????
  ???IT??,??IT???????????????????
• ????????IT????
• ????(GCC)??(???????)IT???????,??????????????????
  
• ????(ABC)?????????????,?????,???????

19
????????IT??
Significant Accounts in the Financial Statements
????? Balance Sheet
??? Income Statement
??????? SCFP
Other
Business Process/ Classes of Transactions
Process C
Process B
Process A
Application Controls Completeness Accuracy
Validity Authorization Segregation of duties
Financial Applications
Application A
Application B
Application C
IT Infrastructure Services
General Computer Controls Program development
Program changes Computer operations Access to
programs and data Control environment
Operating System
Network
Database
20
IT????Cobit

• PCAOB??????????????????????????????????,??????????
  ???????,?????????COSO??COSO??????????,???????IT???
  ????,??,??IT???????????????????,?Cobit?BS7799?ITI
  L??
• CobiT(Control objectives for information and
  related Technology)??ISACA(Information Systems
  Audit and Control Association)?1996???????????????
  ??????????????????????CobiT???????????????IT??????
  ?????????????,??????34?IT??,??4???PO(Planning
  Organization)?AI(Acquisition
  Implementation)?DS(Delivery and
  Support)??Monitoring,?????????302?????,???????????
  ??

21
IT????Cobit
22
IT????Cobit
23
??

• ??
• SOX????
• SOX??????????
• SOX?IT??
• SOX?????

24
SOX???????

• 8. Document Process Results
• Coordination with Auditors
• Internal sign-off (302, 404)
• Independent sign-off (404)

• 3. Identify Significant Controls
• Application controls - over initiating,
  recording, processing reporting
• IT General Controls

• 9. Build Sustainability
• Internal evaluation
• External evaluation

• 5. Evaluate Control Design
• Mitigates control risk to an acceptable level
• Understood by users

• 2. Perform Risk Assessment
• Probability Impact to business
• Size / complexity

• 7. Identify Remediate Deficiencies
• Significant deficiencies
• Material weakness
• Remediation

Business Value

• 1. Plan Scope
• Financial reporting process
• Supporting systems

• 6. Evaluate Operational Effectiveness
• Internal audit
• Technical testing
• Self assessment
• Inquiry
• All locations and controls (annual)

• 4. Document Controls
• Policy manuals
• Procedures
• Narratives
• Flowcharts
• Configurations
• Assessment questionnaires

Sarbanes-Oxley IT Compliance
25
IT????????gtgtgt????

• ?????????
• ????
• ??GCC????????,??????,??????
• ?????
• ????
• ????????
• ???????????
• ??????
• ??
• ??????
• ?????(??)
• ??
• ????
• ???????(??)
• ????(??)???(??)
• ???????

26
IT????????gtgtgt????

• GCC?????????(?????)
• ????
• ????GCC??,??Cobit???????,?????? ?
• ?????
• ???????
• ????
• ????
• ?????????
• ??
• GCC???(??)
• ??
• ??????
• ?????
• GCC?????(??)
• IT?GCC????
• GCC??????
• GCC????

27
IT????????gtgtgt????

• GCC????
• ????
• ??????,??GCC???? ?
• ?????
• ??????
• ????(????)
• ????(??????????)
• ????(??????????)
• ?????(??????????)
• ??(??????????)
• ????????
• ??????
• ??
• GCC????
• ??
• GCC??(??)

28
IT????????gtgtgt????

• ?????
• ????
• ???????,??????GCC?? ?
• ?????
• ????
• ????
• ????
• ??
• GCC??(??)
• ??
• ????
• ????
• ???????
• ???????
• ????

29
IT????????gtgtgt????

• ????
• ????
• ??IT???????,??GCC ?
• ?????
• ?????????
• ????
• ????
• ????
• ??
• ??
• ????
• ???????(??)????AP
• ??????
• ??????????
• ????(??)??????
• ????????

30
IT????????gtgtgt????

• ????
• ????
• ????????????????????,??????,????GCC ?