Sarbanes-Oxley Act

["Milt Habeck" <mhabeck@xxxxxxxxxx>]

Hi John ....

You raise a good point about COBIT and ISO 17799. COBIT 
standards are in the public domain, unlike the ISO content. Here's
more information about each:

       COBIT:  http://www.unbeatenpathintl.com/cobit/source/1.html 
 ISO 17799:  http://www.unbeatenpathintl.com/iso/source/1.html 

These SOX compliance software products for OS/400 target the 
alphabet soup of professional standards (like COBIT and ISO 17799), 
acts of Congress, regulations, FDA requirements, etc.

   http://www.unbeatenpathintl.com/compliancecatalog/source/1.html 
   http://www.unbeatenpathintl.com/socks/source.1.html 

Warm regards,

Milt Habeck
Unbeaten Path International
North America: (888) 874-8008
International: (262) 681-3151
European contact: (44) 1-737-824248
mhabeck@xxxxxxxxxx
www.unpath.com





----- Original Message ----- 
From: John Earl 
To: Midrange Systems Technical Discussion 
Sent: Monday, August 23, 2004 1:21 PM
Subject: RE: Sarbanes & Oxley

 > Most auditors do not know what they are looking for,  the
 > whole thing is very nebulous. 

This is true - and auditors are not great at telling you what to do
right, but are rather good at telling you what you did wrong :(

What auditors will give you good marks for is having picked an IT
standard such as COBIT or ISO17799 and demonstrating your compliance (or
efforts at same) to that standard.  It also makes for a faster and less
expensive audit process if you follow the COBIT script, as opposed to
showing the auditor all of the unique things that you are doing on your own.

jte

John Earl | Chief Technology Officer
The PowerTech Group
19426 68th Ave. S
Seattle, WA 98032
(253) 872-7788 ext. 302
john.earl@xxxxxxxxxxxxx
www.powertech.com