Re: Sarbanes-Oxley / my opinion

There is one additional note about SOX that I think some tend to miss, it is 
not applicable to ALL PUBLIC companies, as in the case with OTC and pink 
sheeted companies which are not required to follow SOX.


On Tue, 4 Apr 2006 11:30:10 -0500, Milt Habeck wrote
> Dear Mark,
> 
> Your  'SOX and BRMS'  post last week has encouraged me 
> to share my personal point of view about SOX.
> 
> In my opinion, Sarbanes-Oxley compliance doesn't require an 
> enterprise to do anything that good business practice did not 
> already require a couple of decades ago. SOX just requires that 
> external auditors do a more thorough job looking for 
> distinctions between world class business practice and how a 
> company actually operates ... and ... it requires that the auditors 
> report those distinctions for review by investors.
> 
> It's not clear how well the "report-it-to-the-investors" part of 
> the legislation is working. If anyone knows of an annual report
> that has included a SOX-type complaint in an audit letter, 
> please tell me more about it. If annual reports of that genre
> can't be found, then we're left with two hypotheses:
> 
>   1. Thousands of publicly traded companies are doing a great 
>       job running their business with sound internal control
>       regimens in all functional areas (including IS).
> 
>   2. The fear of annoying a client and not being invited to
>       perform next year's audit has proved to be more compelling 
>       than the fear of failing to observe the letter of Sarbanes-
> Oxley.
> 
>       [Quite candidly, it's hard to believe hypothesis #1 given the 
>        testimonies I've personally heard from managers across a 
>        broad cross section of manufacturing industries.]
> 
> Long before SOX was invented, pharmaceutical companies
> had much more demanding business practice requirements imposed
> by the FDA. If your enterprise could get system-certified under
> FDA's 21 CFR part 11 rules, SOX would be a cake-walk.
> 
> There are several other IT compliance requirements that pre-date
> SOX and here's a link to information about the better known ones:
> http://www.unbeatenpathintl.com/ITstandards/source/1.html
> 
> You mention BRMS (Business Rule Management System) 
> software and that genre of tool can help an enterprise develop 
> and maintain operational policies. But, it's not going to help much 
> if the purchaser doesn't already grasp what world-class business 
> practices are supposed to look like.
> 
>    Without that intellectual property, the final deliverable won't
>    help improve the quality of operations any more than many of 
>    the ISO 900x policy books I've seen. (I'm referring to the 
>    "just-write-down-what-we-are-already-doing-so-we-can-pass-
>    the-ISO-audit-ASAP" type efforts.)
> 
> Warm regards,
> 
> Milt Habeck
> Founder/President
> Unbeaten Path International
> 
> www.upisox.com  
> (888) 874-8008
> 
> "Unbeaten Path is in the business of 
>   helping enterprises move towards 
>         world class performance"
> 
> +++++++   +++++++   +++++++   +++++++   +++++++   +++++++
> From: "Mark Allen" <scprideandms@xxxxxxxxx>
> To:midrange-l@xxxxxxxxxxxx
> Date: Mon, 27 Mar 2006 14:45:59 
> Subject: SOX and BRMS saves of Application data and Objects
> 
> Looking for some ideas from somebody who's been thru this or at 
> least part of it.  I know a little about BRMS and not even sure 
> "what" the SOX Compliance people MIGHT be looking for.  I know this 
> is vague but its all I got for now. just looking for some general ideas.
> 
> Thanks, also feel free to respond off list.
> 
> -- 
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) 
> mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To 
> subscribe, unsubscribe, or change list options, visit: 
> http://lists.midrange.com/mailman/listinfo/midrange-l or email: 
> MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a moment 
> to review the archives at http://archive.midrange.com/midrange-l.


If you bought it, it was hauled by a truck - somewhere, sometime.