× The internal search function is temporarily non-functional. The current search engine is no longer viable and we are researching alternatives.
As a stop gap measure, we are using Google's custom search engine service.
If you know of an easy to use, open source, search engine ... please contact support@midrange.com.



Sorry folks but I must get back on my band wagon.

See my previous entry on SOX from two weeks ago.

For the record, there is nothing (repeat nothing) in the SOX act or the
standards developed to support it that requires an automatic listing of who
accessed what data and made what changes.

As long as you can demonstrate how access to the data is authorized. (i.e.
group profiles) and can demonstrate who authorized the data change (i.e job
profile or written form approval) , who executed the data change (i.e. a log
book) and finally, who audits for compliance and what are their findings.
(i.e. a report).

Again, don't get hung up on this.  The law and the standards to NOT require
an automatic method of "tracing" data activity.

If you want more info, just ask on line so it can be shared with everyone.
I've received dozens of offline requests.  It's basically the same questions
that everyone is asking.  Let's keep this in the forum so everyone can use.

Kevin Fox
'kdfox@xxxxxxxxxxxxx'

-----Original Message-----
From: Greg Wenzloff [mailto:GWenzloff@xxxxxxxxxxx] 
Sent: Thursday, November 04, 2004 9:12 AM
To: 'mapics-l@xxxxxxxxxxxx'
Subject: Sarbanes - Oxley ----- MAPICS related

Here is an interesting post copied from the Midrange list.   I still think
we will have to maintain audit trails on key MAPICS files.   I missed the
web class on MAPICS - SOX last week.   Anything significant come up during
that session?

Greg


message: 5
date: Thu, 04 Nov 2004 16:17:26 +0000
from: Martin Rowe <martin@xxxxxxxxxx>
subject: Re: Sarbanes-Oxley Act

On Thu, 2004-11-04 at 09:47 -0500, Shields, Ken wrote:
> Hello everyone.
> 
>       Just a general question, perhaps someone knows the answer.
> 
>       As a Canadian subsidiary of a US Corporation, must our software and
methods be 
>       SOX compliant?

Hi Ken

The UK company I work for is now American owned, and we have to comply.
We've had a steady succession of auditors come through our doors for
months, assisting in getting us up to compliance levels. The final audit
starts next week for us in IT, and there's been a lot of work done -
mainly in formalising existing procedures, rather than having to invent
new procedures (fortunately). I can see why it's being done, but it
doesn't half add to the workload of an already busy department.

Is anyone else having to provide audit trails for data changes? We now
have to account for any changes to the production database (iSeries) by
routes other than our standard applications, so the use of SQL, DFU,
WRKDBF, etc has to be captured, along with any updates by IT staff. As
we have journalling enabled it's not too tricky, but I've generated over
300,000 entries myself in the last week (all above board, obviously <g>)
so pity my boss who has to review it ;) 

I did wonder if there was something in QUADJRN that we could trap, for a
list of files updated by user, but I've only found object information so
far. 

Regards, Martin
-- 
martin@xxxxxxxxxx  AIM/Gaim: DBG400dotNet  http://www.dbg400.net       /"\
DBG/400 - DataBase Generation utilities - AS/400 / iSeries Open        \ /
Source free test environment tools and others (file/spool/misc)         X 
[this space for hire]  ASCII Ribbon Campaign against HTML mail & news  / \








As an Amazon Associate we earn from qualifying purchases.

This thread ...

Replies:

Follow On AppleNews
Return to Archive home page | Return to MIDRANGE.COM home page

This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].

Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.