× The internal search function is temporarily non-functional. The current search engine is no longer viable and we are researching alternatives.
As a stop gap measure, we are using Google's custom search engine service.
If you know of an easy to use, open source, search engine ... please contact support@midrange.com.



Lisa,

We keep reminding ourselves and the auditors that SOX puts the audit
firm on the hook for the validity of the financials and the process that
creates them, not for our business decisions made in good faith.  Where
we have queries that are directly in the chain leading to financial
numbers, they are fair game for the audit.  In general, we reconcile
those results periodically to ensure their validity.   These are few in
number and well controlled.  General queries for decision making,
business intelligence and other purposes are outside of the SOX net.

Jim

-----Original Message-----
From: bpcs-l-bounces@xxxxxxxxxxxx [mailto:bpcs-l-bounces@xxxxxxxxxxxx]
On Behalf Of Lisa.Abney@xxxxxxxxxxxxxxxxx
Sent: Thursday, June 10, 2004 8:59 AM
To: SSA's BPCS ERP System
Subject: RE: Sarbanes-Oxley Compliance (Was DB2 Users)

Jim ...

I'm very interested in your comment, in regard to SOX and query, that
auditors are only interested in things that can change data.  We use
user-generated queries very heavily in our company, and I'm concerned
(and
surprised!) that our SOX auditors have not dinged us for that.  Doesn't
the fact that we most likely make business decisions based on the
results of those queries (that are neither tested or change controlled
in any way) cause an alarm somewhere?  While the data on our 400 is
obviously safe from change via query, what good is that if results
people are reviewing and assume are accurate come from a query written
by a user who doesn't understand every detail behind the scenes of BPCS?

Has anyone had SOX auditors raise concerns about user written queries,
and how they are controlled and tested?






"Reinardy, James" <jreinardy@xxxxxxxxxxxxxxx>
Sent by: bpcs-l-bounces@xxxxxxxxxxxx
06/10/2004 08:23 AM
Please respond to "SSA's BPCS ERP System"
 
        To:     "SSA's BPCS ERP System" <bpcs-l@xxxxxxxxxxxx>
        cc: 
        Subject:        RE: Sarbanes-Oxley Compliance (Was DB2 Users)


Ardi,

The auditors are not necessarily raising concerns about read access,
they are more concerned that we have ways of auditing user access and
obtaining approval of the current scheme from our user data owners.  My
concern is that we are in a position that I will have a hard time
defending, the "security by obscurity" mentioned in one of Milt's
product related emails.  So far, that has been the theme of our Sarbox
implementation, the auditors are not quite as concerned about what is
being done as long as it is approved, documented and audited after the
fact.  I have thought about the read access and decided that it truly is
an internal issue, since a query cannot by definition impact the
financial numbers.

On the BPCS side itself, we are pretty comfortable.  We have good
reporting capabilities for BPCS user profiles that was developed some
years ago.  Using that, I can answer most questions.  We are putting a
policy in place that our owners group will review the matrix yearly and
approve the security granted to the rest of the users for objects that
fall into their area.  The approval step on the front end has been in
place for a while, only the after the fact audit is new. We have also
implemented triggers and some exception reporting for a few key files
identified by our internal auditor for more careful monitoring.  This is
very much in line with the strategy outlined in your last paragraph.

Thanks for the reply,

Jim

-----Original Message-----
From: bpcs-l-bounces@xxxxxxxxxxxx [mailto:bpcs-l-bounces@xxxxxxxxxxxx]
On Behalf Of Ardi Batmanghelidj
Sent: Wednesday, June 09, 2004 6:07 PM
To: 'SSA's BPCS ERP System'
Subject: Sarbanes-Oxley Compliance (Was DB2 Users)

Jim

 

Because our compliance product is being used by several companies for
SOX remediation, I have been involved with addressing gaps identified by
many different auditing companies. This is the first time I have
encountered a concern raised about users/programmers ability to see
data. More often, it is ability to change data, which I realize can also
be done through the tools you mention. Are you being asked to limit read
access?

 

As you probably know, the SOX exposure is not only through non-BPCS
capabilities. For example using legitimate programs and authorized
access an errant employee can change, customer addresses, place an
order, and change the customer address back. Using this technique they
can have material shipped to their own homes.  How about making
inappropriate G/L entries using standard BPCS programs, or giving a
buddy a real deep discount?

 

The first line of defense for most companies has been to rely on
printing out huge reports which someone supposedly checks monthly and
signs off. We all know how inefficient and impractical this can be. 

 

I appreciate that triggers and journals raise concerns around system
impact, but we have found that if implemented correctly, the impact is
minimal. An alternative, then, is to monitor for database changes using
some external and electronic facility which captures database changes
regardless of the vehicle for change; DBU, SQL, BPCS, ODBC etc. One
could then configure special exception conditions to escalate
notifications to supervisory personnel, eliminating the need to review
thousands of database changes for that one possible inappropriate
change. Additionally, only relevant audit records can be siphoned off
and kept in a historical database which eliminates the need to keep
journal receivers around. 

 

Good luck with your project.

 

Cheers

Ardi

 

 

-----Original Message-----
From: bpcs-l-bounces@xxxxxxxxxxxx [mailto:bpcs-l-bounces@xxxxxxxxxxxx]
On Behalf Of Reinardy, James
Sent: Wednesday, June 09, 2004 4:18 PM
To: bpcs-l@xxxxxxxxxxxx
Subject: DB2 Users

 

Hello All,

 

We are running BPCS 6.04 on iSeries.  I am trying to understand the

relationship between iSeries users, BPCS users and DB2 file access.  The

concern is arising because of Sarbanes-Oxley.  Our auditors are

suggesting that we need to lock down file privileges against the BPCS

database, but we are a little unclear about what user BPCS uses for data

access against DB2.  Is it the individual user that is logged into BPCS,

that user with a changed profile(SSA perhaps vs. *PUBLIC), or some other

generic user? 

 

The idea here is to restrict access on a file by file basis for

AS400Query, SQL queries, ODBC connections, etc.  However, we want to be

sure if we lock things down that we don't break BPCS screens and batch

jobs.  Any suggestions on how to improve our understanding in this area

would be appreciated.

 

Regards,

 

Jim Reinardy

Director-IS

Badger Meter, Inc.

Milwaukee, WI

_______________________________________________

This is the SSA's BPCS ERP System (BPCS-L) mailing list

To post a message email: BPCS-L@xxxxxxxxxxxx

To subscribe, unsubscribe, or change list options,

visit: http://lists.midrange.com/mailman/listinfo/bpcs-l

or email: BPCS-L-request@xxxxxxxxxxxx

Before posting, please take a moment to review the archives

at http://archive.midrange.com/bpcs-l.

 

 

_______________________________________________
This is the SSA's BPCS ERP System (BPCS-L) mailing list To post a
message email: BPCS-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change
list options,
visit: http://lists.midrange.com/mailman/listinfo/bpcs-l
or email: BPCS-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives at
http://archive.midrange.com/bpcs-l.



_______________________________________________
This is the SSA's BPCS ERP System (BPCS-L) mailing list
To post a message email: BPCS-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/bpcs-l
or email: BPCS-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/bpcs-l.


_______________________________________________
This is the SSA's BPCS ERP System (BPCS-L) mailing list
To post a message email: BPCS-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/bpcs-l
or email: BPCS-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/bpcs-l.




As an Amazon Associate we earn from qualifying purchases.

This thread ...


Follow On AppleNews
Return to Archive home page | Return to MIDRANGE.COM home page

This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].

Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.