Sarbanes-Oxley / my opinion ---- ( chapter 2 )

Good evening,

SOX is much broader than fraud and theft, in my opinion ....
and it must be to protect shareholders.

Yes, it is true that Congress acted in response to the outrage born
from the acute fraud/theft at two major enterprises that failed to
provoke external audit warnings. But the impetus for the legislation
did not end up defining what SOX became. That definition was created
by the Public Company Accounting Oversight Board (PCAOB - or
"Peek-a-Boo") that was empowered by Congress to interpret the
requirements of the legislation .... much like the IRS is empowered to
interpret tax legislation and does so by creating endless pages of
regulations.

An executive overview of what PCAOB ended up doing is reported here:
          http://www.unbeatenpathintl.com/pcaob/source/1.html

Interestingly enough, after reading all 216 pages of SOX regulations
authored by PCAOB, the only three practical illustrations I found
directed auditor's attention to an infinitesimal level of internal control
detail (see the URL) that had nothing to do with either fraud or theft ...
rather, the focus was on world class business practice.

    By the way, I couldn't find the word "computer" in the PCAOB
    material ... I think the big emphasis on computers was invented by
    external auditors as a billing expansion strategy.

Now ... brace yourself for a strongly held opinion. If you added up all the
theft at Enron + Worldcom + Parmalat + other headline disasters, the value
of the losses would be very small (maybe trivial) relative to the losses
suffered by shareholders every year due to poor business practice. That's
what PCAOB is targeting and, if anyone pays attention, that shall be a far
better protection for shareholders.

Permit me to express a comment based on personal observations in a
broad variety of industries located around the world:

   There is what I would call a pervasive (not universal)
   "myth of business competence."

   I have seen very hard working, involved, motivated, loyal employees
   at all corporate levels in big and small companies who don't
   understand the distinctions between what they are doing and
   world class business practice.

     +> The cost of those distinctions is staggering.
     +> Senior management attention to the distinctions is unlikely.
     +> The budget to address those distinctions is generally non-existent.

So, now Congress and Peek-a-Boo are relying on external auditors to find
and disclose the distinctions.

   Here comes another strongly-held point of view: with a notable early 90's
   exception at AA in Argentina, the external auditors I've personally 
   worked with aren't up to the task ... and that includes the recent college 
   grads walking around with questionnaires on clip-boards right on up to 
   the partners. I refer to that as the "myth of auditing competence."

Net point: shareholders have much more to worry about than theft/fraud
and, sadly, the paucity of SOX comments in annual report audit letters 
suggests that the "myth of business competence" remains alive and well
despite the PCAOB regulations.


Warm regards,

Milt Habeck
Founder/President
Unbeaten Path International

www.upisox.com
North America: (888) 874-8008
International: (262) 681-3151

"Unbeaten Path is in the business of
  helping enterprises move towards
        world class performance."





+++++++   +++++++   +++++++    +++++++    +++++++   +++++++
From: John Earl
To: Midrange Systems Technical Discussion
Sent: Tuesday, April 04, 2006 7:28 PM
Subject: Sarbanes-Oxley / my opinion

> I suppose my three immediate questions would be:
> 1. What is SOX intended to prevent?

Fraud and theft, no more, no less.

When you examine it closely, SOX really is an ingeniously crafted piece
of legislation.  Rather than creating long lists of "You Must" clauses
followed by "we will Check on you by..." statements (and a gigantic
federal bureaucracy to match), SOX simply says to the CEO and CFO "You
will sign a letter stating that you have adequate financial controls in
place to prevent fraud and theft.  If you sign that letter and you're
wrong, you could go to jail".  Brilliant!

(See a nice summary of SOX Section 404 at
http://www.aicpa.org/info/sarbanes_oxley_summary.htm)

Congress simply told the head honcho's that it is their butts that are
on the line.  The head honcho's have always had the where-with-all to
turn the organization towards security and best practices, all Congress
did was give them the motivation. :)

Now the Honcho's have to take a critical eye at the organization and ask
themselves...

"If, under our current operating practices, Rocko on the shipping Dock
can steal a semi truck full of widget's and nobody would even know they
are gone, or Jane in IT could open up a hole for Tom in AP to pay
himself 7 digit's as a phony vendor, and there is no way to capture
that, AND I don't deploy the organizations resources in such a way that
I could stop (or at least detect) those actions, I could go to jail."
All of the sudden, the Honcho's want adequate controls in place.  If you
were in their shoes, you would too.

And I know from personal experience that if you take an average
production iSeries system with, say 800 users on it, somewhere between
25% - 100% of those users could rob the place blind because there are
little, or no, controls deployed to prevent this.  In the old days, we
all used to just wink at each other and say "Aww... Our users are too
{(A) Nice, B) Honest, C) Stupid, D) Busy, E) Select your own adjective
}, they are not going to steal from us".  Today the CEO and CFO look at
those 800 people and say "I guess they probably won't steal from us -
but if I guess wrong, I could face criminal charges".

And all of the sudden they start viewing system security differently.
They start orientating themselves to the same posture that IT Security
professionals have had all along - "Nobody gets access on less they
absolutely need it."  You, the System Admin, may think this is useless
and wasteful, but get used to it because it is the future of computing.


> 2. How effective is it at actually enforcing what it's
> intended to
> prevent?

As effective as the CEO wants it to be - everyone has a pain tolerance -
at some point the CEO will decide that there are enough controls in
place that he/she stands a high chance of _not_ going to jail, and will
ease up (a bit).  Personally I think SOX already is very, very
effective, because the folks who have the highest ability to influence
the outcomes (Honcho's) have the most skin in the game.  Again, this
part was pure brilliance.

> 3. What are the new methods of circumventing it?

Remember, SOX does not say how to secure your iSeries (or any other
system).  It does not state an opinion on what QSECURITY level you
should be at, or what your Password Change Interval should be.  It just
says that you must have adequate controls in place, and you must get an
external auditor to agree with you (in writing) that there are adequate
controls in place.  All of the auditors are playing this one very
nervously because they remember what happened to Arthur Anderson.

(An Arthur Anderson "Partner" lied, and committed other crimes, in an
effort to cover up Enron's financial misdeeds.  Because he was a
"Partner", the entire corporation was liable for his crimes, and so the
company was convicted of a felony.  Felons are not allowed to hold
corporate charters, and so on the very day that Arthur Anderson was
convicted of a felony, it lost its license to do business as a
corporation.  On that day a 100+ year old icon of American business just
ceased to exist.)

So there is no _one_ way to "circumvent SOX.   You have (or should have)
a security policy, and then you should manage your business according to
that policy.  Your auditors will generally be happy if they can measure
your adherence to your own written policy, and grade you on how well you
are doing what you said you would do.

That is the essence of SOX.  Do good things.  Manage your company so
that people can not steal from the business without being detected.  If
you do this, you are well on your way to SOX Compliance.   If you don't
do this, maybe you ought not to be the one running the business (or its
IT assets)?

JMHO,

jte



+++++++   +++++++   +++++++    +++++++    +++++++    +++++++    +++++++
From: Milt Habeck
To: Midrange technical discussion group
Sent: Tuesday, April 04, 2006 11:30 AM
Subject: Sarbanes-Oxley / my opinion

In my opinion, Sarbanes-Oxley compliance doesn't require an
enterprise to do anything that good business practice did not
already require a couple of decades ago. SOX just requires that
external auditors do a more thorough job looking for
distinctions between world class business practice and how a
company actually operates ... and ... it requires that the auditors
report those distinctions for review by investors.

It's not clear how well the "report-it-to-the-investors" part of
the legislation is working. If anyone knows of an annual report
that has included a SOX-type complaint in an audit letter,
please tell me more about it. If annual reports of that genre
can't be found, then we're left with two hypotheses:

  1. Thousands of publicly traded companies are doing a great
      job running their business with sound internal control
      regimens in all functional areas (including IS).

  2. The fear of annoying a client and not being invited to
      perform next year's audit has proved to be more compelling
      than the fear of failing to observe the letter of Sarbanes-Oxley.

      [Quite candidly, it's hard to believe hypothesis #1 given the
       testimonies I've personally heard from managers across a
       broad cross section of manufacturing industries.]

Long before SOX was invented, pharmaceutical companies
had much more demanding business practice requirements imposed
by the FDA. If your enterprise could get system-certified under
FDA's 21 CFR part 11 rules, SOX would be a cake-walk.

There are several other IT compliance requirements that pre-date
SOX and here's a link to information about the better known ones:
http://www.unbeatenpathintl.com/ITstandards/source/1.html

You mention BRMS (Business Rule Management System)
software and that genre of tool can help an enterprise develop
and maintain operational policies. But, it's not going to help much
if the purchaser doesn't already grasp what world-class business
practices are supposed to look like.

   Without that intellectual property, the final deliverable won't
   help improve the quality of operations any more than many of
   the ISO 900x policy books I've seen. (I'm referring to the
   "just-write-down-what-we-are-already-doing-so-we-can-pass-
   the-ISO-audit-ASAP" type efforts.)


Warm regards,

Milt Habeck
Founder/President
Unbeaten Path International

www.upisox.com
(888) 874-8008

"Unbeaten Path is in the business of
  helping enterprises move towards
        world class performance."