Re: Sarbanes-Oxley Act

[Martin Rowe <martin@xxxxxxxxxx>]

On Thu, 2004-11-04 at 09:47 -0500, Shields, Ken wrote:
> Hello everyone.
> 
>       Just a general question, perhaps someone knows the answer.
> 
>       As a Canadian subsidiary of a US Corporation, must our software and 
> methods be 
>       SOX compliant?

Hi Ken

The UK company I work for is now American owned, and we have to comply.
We've had a steady succession of auditors come through our doors for
months, assisting in getting us up to compliance levels. The final audit
starts next week for us in IT, and there's been a lot of work done -
mainly in formalising existing procedures, rather than having to invent
new procedures (fortunately). I can see why it's being done, but it
doesn't half add to the workload of an already busy department.

Is anyone else having to provide audit trails for data changes? We now
have to account for any changes to the production database (iSeries) by
routes other than our standard applications, so the use of SQL, DFU,
WRKDBF, etc has to be captured, along with any updates by IT staff. As
we have journalling enabled it's not too tricky, but I've generated over
300,000 entries myself in the last week (all above board, obviously <g>)
so pity my boss who has to review it ;) 

I did wonder if there was something in QUADJRN that we could trap, for a
list of files updated by user, but I've only found object information so
far. 

Regards, Martin
-- 
martin@xxxxxxxxxx  AIM/Gaim: DBG400dotNet  http://www.dbg400.net       /"\
DBG/400 - DataBase Generation utilities - AS/400 / iSeries Open        \ /
Source free test environment tools and others (file/spool/misc)         X 
[this space for hire]  ASCII Ribbon Campaign against HTML mail & news  / \