Re: Change Management

Excellent post Bob!

One good method to get some control over your SOX auditors is to create
detailed policy and procedure documents. Get these documents signed
off by the highest person on the food chain you can get to. Then
auditors must evaluate how you are performing according to the policies
which you wrote. Should be pretty easy. If they don't like
something in the policy - send them up the food chain.

Greg

-----Original Message-----
From: Heavilin, Bob [mailto:BHeavilin@xxxxxxxxxxxx]
Sent: Friday, July 25, 2008 7:49 AM
To: MAPICS ERP System Discussion
Subject: Re: [MAPICS-L] Change Management

We also use Track-It and have found it to be a very good tool, and we
use Track-It reports to provide SOX documentation.

Regarding SOX requirements, we should all remember that SOX is intended
to provide financial controls. Too often, SOX auditors recommend SOX
procedures for non-financial applications. These may or may not be
valuable controls, but they should not be enforced due to SOX. It seems
that auditors do their best to justify their own existence, and this is
one of the ways they do it.

If your SOX auditors are insisting on controls over all files, all
programs, all MAPICS modules, you would be within your rights to remind
them of the purpose of SOX.

Regards,
Bob Heavilin
Division Project / EDI Manager
Stant Manufacturing, Inc.