Re: Sarbanes-Oxley request to install iSphere library

[Sam_L <lennon_s_j@xxxxxxxxxxx>]

Dan,

FWIW, the library does not have to be called ISPHERE. You can, if there 
are no conflicts, use an existing library, though you will probably have 
to download the source and compile it (see 
http://isphere.sourceforge.net/help/).  Compilation is a simple process, 
but obviously takes more effort than just restoring a library.

However, it would seem to me that your shop must have a process 
(probably a form) to request a new library. A development library 
generally isn't of interest to auditors.  My experience is with JSOX, 
the Japanese version of SOX (we were a USA subsidiary of a publicly 
traded Japanese company).  The auditors (a major USA company) never were 
interested in our development libraries. Their main concern was that 
developers could not change production code or production data and that 
users could not get a command line. I generally found them not to be 
unreasonable, as long as you didn't try to circumvent them.  Your 
colleague may be on the right track.

Sam

On 8/5/2015 8:19 AM, Dan wrote:
> Developers don't have authority to restore or even create libraries at the
> shop I just started in.  So, in order to get the ISPHERE library installed,
> I need to submit a request to the auditors for their approval.
>
> I'm wondering if anyone has a template I can use.  I'm not intimately
> familiar with SOX, but I imagine they'll be raising flags on this for the
> open source, because, you know, auditors.
>
> A colleague suggested mentioning that it is a development tool for
> technical use, and no end users will ever use this library.
>
> Ideas?
>
> - Dan