..:: Valiant Technologies - Information Security Consulting, Education and Training...

Control assessment for SOX compliance
Sarbanes Oxley Act, 2002 (SOX) was discussed and enacted into law by the 107 th Congress of the United States that began on the 23 rd of January, 2002. The culmination of efforts by Senator Paul Sarbanes and Representative Michael Oxley to bring into being a comprehensive legislation to remedy the situation arising out of corporate failures in quick succession and falling investor confidence. While it had long been recognized that internal controls is the responsibility of top management, this law formalizes this recognition and sets it in a firm and enforceable legal framework. SOX requires senior management and business process owners to establish and maintain an adequate internal control structure. In addition and perhaps more importantly, it expects them to assess the effectiveness of the control system on an annual basis.
Hardly any enterprise today can have an internal control system that is not dependent on information technology. Recognizing this relationship well, the Public Companies Accounting Oversight Board (PCAOB) states in its Accounting Standard No. 2 that “the nature and characteristics of a company’s use of information technology in its information system affect the company’s internal control over financial reporting. ” Formalizing the process, SOX identifies certain managerial positions as certifying officers and expects that they make periodic certifications with respect to the internal controls in the organization with special reference to financial reporting.
IT Security Audit across the organization encompassing Password management Anti-Virus Management Network Security at perimeter Firewall configuration IDS management Database security Application Controls Operational Controls Strategic and management controls Firewall configuration IDS management Database security Application Controls Operational Controls Strategic and management controls