Analysis of Sarbanes-Oxley and IT Control: Robert Freeman

1
Analysis of Sarbanes-Oxley and IT Control
Robert Freeman
2
Agenda

• Introduction
• The Origins of Sarbanes-Oxley and IT Auditing
• Examining IT Governance Controls
• Creating Value
• Assessing Trust
• Conclusion

3
The Origins of Sarbanes-Oxley and IT Control

• Sarbanes-Oxley was passed in July, 2002 to
  correct problems of internal control in both
  accounting and IT areas.
• Created the PCAOB, as well as further
  requirements on management.
• Code of Ethics required, but still comes from
  corporate attitude.
• History of IT control stems from Equity Funding
  Corporation of America scandal, 1973.
• CobiT 4.1 latest version of internal control.

4
Examining IT Governance Controls

• Utilizing document of controls from the IT
  Governance Institute.
• Important Objectives
• Understanding the organizations internal control
  program and its financial reporting process.
• Identifying risks related to these IT systems,
  designing and implementing controls designed to
  mitigate the identified risks and monitoring them
  for continued effectiveness.
• Monitoring IT controls for effective operation
  over time.

5
IT Control Road Map
Source http//www.inforica.com/consult-compliance
.html
6
Examining IT Governance Control

• Types of Controls
• Entity-Level Controls useful on a macro scale.
• Activity-Level Controls good for accounting
  applications, such as the general ledger.
• Road Map
• Important for measuring scope, formalizing the
  process.
• Critical for long-term sustainability of IT
  control implementation.
• Human Factor
• Change of culture must begin from top-down.

7
Creating Value

• Sarbanes-Oxley must be able to foster trust,
  confidence, compliance, and improve company
  value.
• Negative
• Has increased company expenses by 130, hurt
  small businesses.
• Positive
• Has encouraged change in controls, culture.
• Companies are creating greater returns on value
  through improved IT governance structures.

8
Assessing Trust

• Trust and confidence between parties is important
  for greater returns from market.
• Negative
• Investors want to see positive returns,
  regardless of status of companys internal
  process control.
• Positive
• Companies are improving controls, not racing to
  the bottom.
• Quantity and quality of financial information to
  investors has improved.

9
Conclusion

• IT will continue to grow in importance as a means
  of communication and control.
• Sarbanes-Oxley is a good start, but not enough.
• Companies must create value through change in
  culture, and improvement in controls in all
  departments, including IT (increased
  flexibility).
• Compliance is not enough to create value.

10
Questions