RE: PROGRAMMER ACCESS TO PRODUCTION ENVIRONMENT

Greg,

Nothing in the SOX 404 requirements, require that IT provide a computer
generated "audit trail".

A manual procedure along with concomitant internal audit controls, are all
that is required.  Remember, SOX was written with the knowledge that some
companies do not have computer systems.

If your "real" auditor is telling you different, they are ripping you off.

Kevin Fox
kdfox@xxxxxxxxxxxxx

P.S.  I've been involved with 3 different MAPICS/SOX audits and have passed
all three.  And no, I will not be doing anymore.

-----Original Message-----
From: Greg Wenzloff [mailto:GWenzloff@xxxxxxxxxxx] 
Sent: Monday, October 25, 2004 7:14 AM
To: 'MAPICS ERP System Discussion'
Subject: RE: PROGRAMMER ACCESS TO PRODUCTION ENVIRONMENT

It's good that you have a process to approve the changes.  But how do you
meet the Sarbanes - Oxley requirement to keep a record of the changes that
occur to the security file(s)?   Your approval papers do nothing for that.
Do you have a trigger program recording changes or journaling?

These paper trails might work for a newbie auditor but a real auditor will
fail you.   You have not complied with the law.

Greg



-----Original Message-----
From: Don [mailto:dr2@xxxxxxxxxxxx] 
Sent: Monday, October 25, 2004 10:01 AM
To: MAPICS ERP System Discussion
Subject: Re: PROGRAMMER ACCESS TO PRODUCTION ENVIRONMENT



Tim,

I'm glad you're comfy with this arrangement.  I used to really hate it
when IT was nothing more than a big adding machine to balance accounting's
G/L...

I use a form that mimics the security assignment screens by application
and the application owner has to signoff on that...

Don in DC

-----------

On Mon, 25 Oct 2004 Tim.Bertnick@xxxxxxxxxxxxxxxx wrote:

> Good morning - re: setting up MAPICS security, our head of accounting must
> sign off on all MAPICS security changes - our auditors seem OK with this.
> _______________________________________________
> This is the MAPICS ERP System Discussion (MAPICS-L) mailing list
> To post a message email: MAPICS-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/mapics-l
> or email: MAPICS-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/mapics-l.
>

_______________________________________________
This is the MAPICS ERP System Discussion (MAPICS-L) mailing list
To post a message email: MAPICS-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/mapics-l
or email: MAPICS-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/mapics-l.