|
Lisa, We keep reminding ourselves and the auditors that SOX puts the audit firm on the hook for the validity of the financials and the process that creates them, not for our business decisions made in good faith. Where we have queries that are directly in the chain leading to financial numbers, they are fair game for the audit. In general, we reconcile those results periodically to ensure their validity. These are few in number and well controlled. General queries for decision making, business intelligence and other purposes are outside of the SOX net. Jim -----Original Message----- From: bpcs-l-bounces@xxxxxxxxxxxx [mailto:bpcs-l-bounces@xxxxxxxxxxxx] On Behalf Of Lisa.Abney@xxxxxxxxxxxxxxxxx Sent: Thursday, June 10, 2004 8:59 AM To: SSA's BPCS ERP System Subject: RE: Sarbanes-Oxley Compliance (Was DB2 Users) Jim ... I'm very interested in your comment, in regard to SOX and query, that auditors are only interested in things that can change data. We use user-generated queries very heavily in our company, and I'm concerned (and surprised!) that our SOX auditors have not dinged us for that. Doesn't the fact that we most likely make business decisions based on the results of those queries (that are neither tested or change controlled in any way) cause an alarm somewhere? While the data on our 400 is obviously safe from change via query, what good is that if results people are reviewing and assume are accurate come from a query written by a user who doesn't understand every detail behind the scenes of BPCS? Has anyone had SOX auditors raise concerns about user written queries, and how they are controlled and tested? "Reinardy, James" <jreinardy@xxxxxxxxxxxxxxx> Sent by: bpcs-l-bounces@xxxxxxxxxxxx 06/10/2004 08:23 AM Please respond to "SSA's BPCS ERP System" To: "SSA's BPCS ERP System" <bpcs-l@xxxxxxxxxxxx> cc: Subject: RE: Sarbanes-Oxley Compliance (Was DB2 Users) Ardi, The auditors are not necessarily raising concerns about read access, they are more concerned that we have ways of auditing user access and obtaining approval of the current scheme from our user data owners. My concern is that we are in a position that I will have a hard time defending, the "security by obscurity" mentioned in one of Milt's product related emails. So far, that has been the theme of our Sarbox implementation, the auditors are not quite as concerned about what is being done as long as it is approved, documented and audited after the fact. I have thought about the read access and decided that it truly is an internal issue, since a query cannot by definition impact the financial numbers. On the BPCS side itself, we are pretty comfortable. We have good reporting capabilities for BPCS user profiles that was developed some years ago. Using that, I can answer most questions. We are putting a policy in place that our owners group will review the matrix yearly and approve the security granted to the rest of the users for objects that fall into their area. The approval step on the front end has been in place for a while, only the after the fact audit is new. We have also implemented triggers and some exception reporting for a few key files identified by our internal auditor for more careful monitoring. This is very much in line with the strategy outlined in your last paragraph. Thanks for the reply, Jim -----Original Message----- From: bpcs-l-bounces@xxxxxxxxxxxx [mailto:bpcs-l-bounces@xxxxxxxxxxxx] On Behalf Of Ardi Batmanghelidj Sent: Wednesday, June 09, 2004 6:07 PM To: 'SSA's BPCS ERP System' Subject: Sarbanes-Oxley Compliance (Was DB2 Users) Jim Because our compliance product is being used by several companies for SOX remediation, I have been involved with addressing gaps identified by many different auditing companies. This is the first time I have encountered a concern raised about users/programmers ability to see data. More often, it is ability to change data, which I realize can also be done through the tools you mention. Are you being asked to limit read access? As you probably know, the SOX exposure is not only through non-BPCS capabilities. For example using legitimate programs and authorized access an errant employee can change, customer addresses, place an order, and change the customer address back. Using this technique they can have material shipped to their own homes. How about making inappropriate G/L entries using standard BPCS programs, or giving a buddy a real deep discount? The first line of defense for most companies has been to rely on printing out huge reports which someone supposedly checks monthly and signs off. We all know how inefficient and impractical this can be. I appreciate that triggers and journals raise concerns around system impact, but we have found that if implemented correctly, the impact is minimal. An alternative, then, is to monitor for database changes using some external and electronic facility which captures database changes regardless of the vehicle for change; DBU, SQL, BPCS, ODBC etc. One could then configure special exception conditions to escalate notifications to supervisory personnel, eliminating the need to review thousands of database changes for that one possible inappropriate change. Additionally, only relevant audit records can be siphoned off and kept in a historical database which eliminates the need to keep journal receivers around. Good luck with your project. Cheers Ardi -----Original Message----- From: bpcs-l-bounces@xxxxxxxxxxxx [mailto:bpcs-l-bounces@xxxxxxxxxxxx] On Behalf Of Reinardy, James Sent: Wednesday, June 09, 2004 4:18 PM To: bpcs-l@xxxxxxxxxxxx Subject: DB2 Users Hello All, We are running BPCS 6.04 on iSeries. I am trying to understand the relationship between iSeries users, BPCS users and DB2 file access. The concern is arising because of Sarbanes-Oxley. Our auditors are suggesting that we need to lock down file privileges against the BPCS database, but we are a little unclear about what user BPCS uses for data access against DB2. Is it the individual user that is logged into BPCS, that user with a changed profile(SSA perhaps vs. *PUBLIC), or some other generic user? The idea here is to restrict access on a file by file basis for AS400Query, SQL queries, ODBC connections, etc. However, we want to be sure if we lock things down that we don't break BPCS screens and batch jobs. Any suggestions on how to improve our understanding in this area would be appreciated. Regards, Jim Reinardy Director-IS Badger Meter, Inc. Milwaukee, WI _______________________________________________ This is the SSA's BPCS ERP System (BPCS-L) mailing list To post a message email: BPCS-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change list options, visit: http://lists.midrange.com/mailman/listinfo/bpcs-l or email: BPCS-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at http://archive.midrange.com/bpcs-l. _______________________________________________ This is the SSA's BPCS ERP System (BPCS-L) mailing list To post a message email: BPCS-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change list options, visit: http://lists.midrange.com/mailman/listinfo/bpcs-l or email: BPCS-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at http://archive.midrange.com/bpcs-l. _______________________________________________ This is the SSA's BPCS ERP System (BPCS-L) mailing list To post a message email: BPCS-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change list options, visit: http://lists.midrange.com/mailman/listinfo/bpcs-l or email: BPCS-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at http://archive.midrange.com/bpcs-l. _______________________________________________ This is the SSA's BPCS ERP System (BPCS-L) mailing list To post a message email: BPCS-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change list options, visit: http://lists.midrange.com/mailman/listinfo/bpcs-l or email: BPCS-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at http://archive.midrange.com/bpcs-l.
As an Amazon Associate we earn from qualifying purchases.
This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].
Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.
midrange.com
