Sarbanes-Oxley Compliance Using COBIT and Open Source Tools

Christian B Lahti, Roderick Peterson

• Publisher: Syngress
• Year: 2005
• eBook ISBN: 9780080489674
• Topic: Computer Science
• Subtopic: Computer Science General
• Index: Computer Science

This book illustrates the many Open Source cost savings opportunities available to companies seeking Sarbanes-Oxley compliance. It also provides examples of the Open Source infrastructure components that can and should be made compliant. In addition, the book clearly documents which Open Source tools you should consider using in the journey towards compliance. Although many books and reference material have been authored on the financial and business side of Sox compliance, very little material is available that directly address the information technology considerations, even less so on how Open Source fits into that discussion.Each chapter begins with an analysis of the business and technical ramifications of Sarbanes-Oxley as regards to topics covered before moving into the detailed instructions on the use of the various Open Source applications and tools relating to the compliance objectives.- Shows companies how to use Open Source tools to achieve SOX compliance, which dramatically lowers the cost of using proprietary, commercial applications- Only SOX compliance book specifically detailing steps to achieve SOX compliance for IT Professionals

Chapter 1

Overview: The Goals of This Book

Solutions in this chapter:

The Audit Experience: An Introduction

What This Book Is

What This Book Is Not

Who Should Read This Book

The “Live” CD Concept

The Portals

Summary

Solutions Fast Track

Frequently Asked Questions

The Audit Experience: An Introduction

Imagine yourself as Bob, the busy IT manager of a moderately sized company. You are trying to stay on top of the daily problems of the environment—user needs, new systems to deploy, the normal. You have noticed a few unfamiliar faces, provided access to the guest network and perhaps a phone extension for them in the Accounting department while they are busy humming away, bustling back and forth between the CIO and the Controller’s office muttering something about a big audit coming up. “Big deal, we always have an annual audit,” you say to yourself as you toil away at the operational tasks to be done. While chatting in the office kitchen with Beth the accounts payables clerk about the activity in her department, you notice she looks a bit harried as she mutters something about having to produce yet another set of reports for the auditors. “Well, the IT department is involved in the annual audit every year, and we haven’t had any major problems so far,” you comment, giving her a consoling pat on the shoulder as you walk away. Thinking about the audit, the auditors seem to ask the same set of questions from the same set of papers, and your response pages must be rote to them. Oh well, business as usual, until…

Your phone rings, and you are called into a meeting with the CEO, CIO, and Controller to discuss this “SOX” thing. The expected crowd is there along with a couple of those slightly familiar faces you have seen around the office. “Bob, this is Bill and Jane from WeHelpU Consulting, and they have been spending the past couple of months helping us to prepare for our Sarbanes-Oxley audit,” says the CIO. The consultants go on to explain that they are there to help Finance analyze their business processes and reporting structures for the financial chain, and after a few minutes your eyes begin to glaze over so you decide to read your e-mail; after all, meetings are the best time to catch up on this sort of thing. You nod a few times when your name is mentioned, catching phrases here and there such as “control objectives” and “material weakness”… say that doesn’t sound too good. Wait a minute! You suddenly realize these people have been here for several months and you are just now getting dragged into something that you instantly know you really don’t want any part of, but it is becoming apparent that unfortunately you will have no choice in the matter. Moreover, these people are all acting as if you have been clued in from day one! “Ok, no problem” you say after listening to them intently, “we will just revamp the old audit material from last year and add to it what we need.” Everyone agrees that it sounds like a reasonable place to start, and the meeting is adjourned, but somewhere in the back of your mind, something tells you this is going to be anything but the ordinary run-of-the-mill audit. It would be unwise for you to ignore that feeling, because it happens to be true.

Whether this story has any shred of similarity to your introduction to the seemingly long road to Sarbanes-Oxley compliance, the fact is that as an IT professional, whether you are a system administrator or a CIO, at some point this will become a major blip on your radar screen if you work for a publicly held company.

NOTE

Even if you are not an IT professional, we ...

Table of contents

• Cover image
• Title page
• Table of Contents
• Register for Free Membership to [email protected]
• Copyright
• Acknowledgments
• Authors
• Contributors
• Author Acknowledgments
• Chapter 1: Overview: The Goals of This Book
• Chapter 2: SOX and COBIT Defined
• Chapter 3: The Cost of Compliance
• Chapter 4: Why Open Source?
• Chapter 5: Domain I: Planning and Organization
• Chapter 6: Domain II: Acquisition and Implementation
• Chapter 7: Domain III: Delivery and Support
• Chapter 8: Domain IV: Monitoring
• Chapter 9: Putting It All Together
• Appendix A: COBIT Control Objectives
• Appendix B: KNOPPIX Live CD Parameters
• Appendix C: The GNU General Public License
• Appendix D: CD Contents at a Glance
• Index