|
midrange.com
Jim ...
I'm very interested in your comment, in regard to SOX and query, that
auditors are only interested in things that can change data. We use
user-generated queries very heavily in our company, and I'm concerned (and
surprised!) that our SOX auditors have not dinged us for that. Doesn't
the fact that we most likely make business decisions based on the results
of those queries (that are neither tested or change controlled in any way)
cause an alarm somewhere? While the data on our 400 is obviously safe
from change via query, what good is that if results people are reviewing
and assume are accurate come from a query written by a user who doesn't
understand every detail behind the scenes of BPCS?
Has anyone had SOX auditors raise concerns about user written queries, and
how they are controlled and tested?
"Reinardy, James" <jreinardy@xxxxxxxxxxxxxxx>
Sent by: bpcs-l-bounces@xxxxxxxxxxxx
06/10/2004 08:23 AM
Please respond to "SSA's BPCS ERP System"
To: "SSA's BPCS ERP System" <bpcs-l@xxxxxxxxxxxx>
cc:
Subject: RE: Sarbanes-Oxley Compliance (Was DB2 Users)
Ardi,
The auditors are not necessarily raising concerns about read access,
they are more concerned that we have ways of auditing user access and
obtaining approval of the current scheme from our user data owners. My
concern is that we are in a position that I will have a hard time
defending, the "security by obscurity" mentioned in one of Milt's
product related emails. So far, that has been the theme of our Sarbox
implementation, the auditors are not quite as concerned about what is
being done as long as it is approved, documented and audited after the
fact. I have thought about the read access and decided that it truly is
an internal issue, since a query cannot by definition impact the
financial numbers.
On the BPCS side itself, we are pretty comfortable. We have good
reporting capabilities for BPCS user profiles that was developed some
years ago. Using that, I can answer most questions. We are putting a
policy in place that our owners group will review the matrix yearly and
approve the security granted to the rest of the users for objects that
fall into their area. The approval step on the front end has been in
place for a while, only the after the fact audit is new. We have also
implemented triggers and some exception reporting for a few key files
identified by our internal auditor for more careful monitoring. This is
very much in line with the strategy outlined in your last paragraph.
Thanks for the reply,
Jim
-----Original Message-----
From: bpcs-l-bounces@xxxxxxxxxxxx [mailto:bpcs-l-bounces@xxxxxxxxxxxx]
On Behalf Of Ardi Batmanghelidj
Sent: Wednesday, June 09, 2004 6:07 PM
To: 'SSA's BPCS ERP System'
Subject: Sarbanes-Oxley Compliance (Was DB2 Users)
Jim
Because our compliance product is being used by several companies for
SOX remediation, I have been involved with addressing gaps identified by
many different auditing companies. This is the first time I have
encountered a concern raised about users/programmers ability to see
data. More often, it is ability to change data, which I realize can also
be done through the tools you mention. Are you being asked to limit read
access?
As you probably know, the SOX exposure is not only through non-BPCS
capabilities. For example using legitimate programs and authorized
access an errant employee can change, customer addresses, place an
order, and change the customer address back. Using this technique they
can have material shipped to their own homes. How about making
inappropriate G/L entries using standard BPCS programs, or giving a
buddy a real deep discount?
The first line of defense for most companies has been to rely on
printing out huge reports which someone supposedly checks monthly and
signs off. We all know how inefficient and impractical this can be.
I appreciate that triggers and journals raise concerns around system
impact, but we have found that if implemented correctly, the impact is
minimal. An alternative, then, is to monitor for database changes using
some external and electronic facility which captures database changes
regardless of the vehicle for change; DBU, SQL, BPCS, ODBC etc. One
could then configure special exception conditions to escalate
notifications to supervisory personnel, eliminating the need to review
thousands of database changes for that one possible inappropriate
change. Additionally, only relevant audit records can be siphoned off
and kept in a historical database which eliminates the need to keep
journal receivers around.
Good luck with your project.
Cheers
Ardi
-----Original Message-----
From: bpcs-l-bounces@xxxxxxxxxxxx [mailto:bpcs-l-bounces@xxxxxxxxxxxx]
On Behalf Of Reinardy, James
Sent: Wednesday, June 09, 2004 4:18 PM
To: bpcs-l@xxxxxxxxxxxx
Subject: DB2 Users
Hello All,
We are running BPCS 6.04 on iSeries. I am trying to understand the
relationship between iSeries users, BPCS users and DB2 file access. The
concern is arising because of Sarbanes-Oxley. Our auditors are
suggesting that we need to lock down file privileges against the BPCS
database, but we are a little unclear about what user BPCS uses for data
access against DB2. Is it the individual user that is logged into BPCS,
that user with a changed profile(SSA perhaps vs. *PUBLIC), or some other
generic user?
The idea here is to restrict access on a file by file basis for
AS400Query, SQL queries, ODBC connections, etc. However, we want to be
sure if we lock things down that we don't break BPCS screens and batch
jobs. Any suggestions on how to improve our understanding in this area
would be appreciated.
Regards,
Jim Reinardy
Director-IS
Badger Meter, Inc.
Milwaukee, WI
_______________________________________________
This is the SSA's BPCS ERP System (BPCS-L) mailing list
To post a message email: BPCS-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/bpcs-l
or email: BPCS-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/bpcs-l.
_______________________________________________
This is the SSA's BPCS ERP System (BPCS-L) mailing list To post a
message email: BPCS-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change
list options,
visit: http://lists.midrange.com/mailman/listinfo/bpcs-l
or email: BPCS-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives at
http://archive.midrange.com/bpcs-l.
_______________________________________________
This is the SSA's BPCS ERP System (BPCS-L) mailing list
To post a message email: BPCS-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/bpcs-l
or email: BPCS-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/bpcs-l.
As an Amazon Associate we earn from qualifying purchases.
This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].
Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.
