TABLE OF CONTENTS As a result of the financial scandals at major Fortune 100 companies in 2001, Congress enacted the Sarbanes-Oxley Act of 2002. This act affects how public companies report financials, and significantly impacts IT. Sarbanes-Oxley compliance requires more than documentation and/or establishment of financial controls; it also requires the assessment of a company s IT infrastructure, operations, and personnel. Unfortunately, the requirements of the Sarbanes-Oxley Act of 2002 do not scale based on the size or revenue of a company. Small to medium-sized companies (IT department) will face unique challenges, both budgetary and with personnel, in their effort to comply with the Sarbanes-Oxley Act of 2002.
It is not clear that the intent of SOX could not have been met with the requirements under Section 302. However, with the requirements included under Section 404, companies need a framework for implementation. COBIT provides a methodical approach to the IT function for Sarbanes-Oxley implementation and support. While using the framework provided, each company will need to customize the approach to its own size and complexity. A multinational, multidivisional organization is different from a single factory domestic company. The authors provide an example for this customization and rightfully point out that SOX will evolve over time, at least for the first few years.
Steve Lanza
There continues to be much controversy and debate about the effectiveness of SOX. Although most people who are aware of the requirements to comply with SOX (Section...
