RE: Sarbanes - Oxley ----- MAPICS related

["Kandel, Ed" <EKandel@xxxxxxxxxxxxxxxxxxxxx>]

I attended the MAPICS SOX Tech Talk, it may be valuable if you were not
already using the MAPICS Security Reports for data owner review.  It was a
good primer to get started with MAPICS Security Administration.

But, if you were looking for answers on audit or control of programmer or
privileged User ID accounts to comply with SOX, there was nothing there.
But, that's not the MAPICS, Inc. area of specialty, so not too surprising.

Best Regards, 
Ed Kandel
 

-----Original Message-----
From: Greg Wenzloff [mailto:GWenzloff@xxxxxxxxxxx] 
Sent: Thursday, November 04, 2004 12:12 PM
To: 'mapics-l@xxxxxxxxxxxx'
Subject: Sarbanes - Oxley ----- MAPICS related

Here is an interesting post copied from the Midrange list.   I still think
we will have to maintain audit trails on key MAPICS files.   I missed the
web class on MAPICS - SOX last week.   Anything significant come up during
that session?

Greg


message: 5
date: Thu, 04 Nov 2004 16:17:26 +0000
from: Martin Rowe <martin@xxxxxxxxxx>
subject: Re: Sarbanes-Oxley Act

On Thu, 2004-11-04 at 09:47 -0500, Shields, Ken wrote:
> Hello everyone.
> 
>       Just a general question, perhaps someone knows the answer.
> 
>       As a Canadian subsidiary of a US Corporation, must our software and
methods be 
>       SOX compliant?

Hi Ken

The UK company I work for is now American owned, and we have to comply.
We've had a steady succession of auditors come through our doors for
months, assisting in getting us up to compliance levels. The final audit
starts next week for us in IT, and there's been a lot of work done -
mainly in formalising existing procedures, rather than having to invent
new procedures (fortunately). I can see why it's being done, but it
doesn't half add to the workload of an already busy department.

Is anyone else having to provide audit trails for data changes? We now
have to account for any changes to the production database (iSeries) by
routes other than our standard applications, so the use of SQL, DFU,
WRKDBF, etc has to be captured, along with any updates by IT staff. As
we have journalling enabled it's not too tricky, but I've generated over
300,000 entries myself in the last week (all above board, obviously <g>)
so pity my boss who has to review it ;) 

I did wonder if there was something in QUADJRN that we could trap, for a
list of files updated by user, but I've only found object information so
far. 

Regards, Martin
-- 
martin@xxxxxxxxxx  AIM/Gaim: DBG400dotNet  http://www.dbg400.net       /"\
DBG/400 - DataBase Generation utilities - AS/400 / iSeries Open        \ /
Source free test environment tools and others (file/spool/misc)         X 
[this space for hire]  ASCII Ribbon Campaign against HTML mail & news  / \




_______________________________________________
This is the MAPICS ERP System Discussion (MAPICS-L) mailing list
To post a message email: MAPICS-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/mapics-l
or email: MAPICS-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/mapics-l.