Solved

Sample SOX and audit reports?

Posted on 2004-09-16
3
1,066 Views
Last Modified: 2012-05-05
Does anybody know where I could grab some sample SOX and audit reports? If not, could you point me to a link that better explains how my application or work adheres to SOX?
0
Comment
Question by:drakkarnoir
  • 2
3 Comments
 
LVL 1

Accepted Solution

by:
dommurray earned 500 total points
Comment Utility
When you say sample audit reports, do you mean what an auditor checks for during an audit or a saple of what they might find?
Either way I don't think you'll have much luck there. The best way to approach what you may need for SOX from an IT (especially security) point of view is:

Does a control which I am in charge of work correctly to achieve what it is supposed to:

Take a simplae example:

SOX (amongst other things) is about accountability & control, especially over financial information. You will have to understand where that crossover is for your specific company.

If you have an NT enviroment for example, NT login may be the way that a person get's access to an accounting application or spreadsheet, either through user or group security settings. An auditor will want to see which users have access to that group & should they have access, what controls are in place to ensure that if a user role changes or a user leaves the company, is there a process in place to make the changes? The auditor will want to see proof that it has been done according to your procedure also.
An auditor for example may ask for proof that a person that has left your company has had any accounts disabled or deleted (depending on what your policy is).

Basically if you say "we do this" you'll have to prove it, especially where it involves access to your company's financial information (payroll, accounts, customer info etc) SOX does dot specify however what the "this" is, it's not like ISO or BS where it's a little more clear.
For me the best guidelines are:
"what do I need to control where the finances of my company are concerned(from an IT Security perspective of course)"
"how do I control it"
Document the control and how it is done (policy & procedure, both are important)
"have I implemented it correctly"
"can I prove that I have implemented and am executing the control"

I know this is all still a little vague but then again so is SOX. It's new to everyone still and from my experience so far even the auditors find some areas of IT control a litle "grey" on what they need to ans should be checking. Also remember that SOX is still new, it's been around for 2 years byt the actual process of companys being audited has only started recently.

However if you want some categories, the following may be a start:

virus protection
password policy
e-mail use
internet use
instant messaging!! use
remote access
application administration (a specific application may have financial info in it and have it's own independant secutiy controls)
3rd party access
data classification (if you don't let people know something is confidential, how do they know they shouldn't pass it on to anyone who shouldn't have it!)
security administration (NT, AD etc etc)
Exceptions policy (example: if you have a password policy that can't be applied to a specific application, you need to state that it is an exception and you need a rule on how to govern this, exception can be used in a situation where there may be different laws in different countries where your comapny has offices, that may affect e-mail use and internet surfing (especially privacy laws))


This is not an absolute list and some of it may not be appropriate for you company but these will show that you are maintaining controls.

But sorry, I don't know any places where there are specific types of SOX documents, but I hope the rest helps.
There is the official SOX site, but if you read the part that refers to IT controls it won't help you much, there's not much too it.

Anyway best of luck, I know of some of the pain you are about to go through.

DJM
0
 
LVL 1

Expert Comment

by:dommurray
Comment Utility
Sorry about some of my spelling & grammar but I was in a hurry!
0
 

Author Comment

by:drakkarnoir
Comment Utility
Excellent, thanks.
0

Featured Post

Comprehensive Backup Solutions for Microsoft

Acronis protects the complete Microsoft technology stack: Windows Server, Windows PC, laptop and Surface data; Microsoft business applications; Microsoft Hyper-V; Azure VMs; Microsoft Windows Server 2016; Microsoft Exchange 2016 and SQL Server 2016.

Join & Write a Comment

Phishing is at the top of most security top 10 efforts you should be pursuing in 2016 and beyond. If you don't have phishing incorporated into your Security Awareness Program yet, now is the time. Phishers, and the scams they use, are only going to …
This story has been written with permission from the scammed victim, a valued client of mine – identity protected by request.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now