Re: Sarbanes-Oxley request to install iSphere library

Dan,

FWIW, the library does not have to be called ISPHERE. You can, if there are no conflicts, use an existing library, though you will probably have to download the source and compile it (see http://isphere.sourceforge.net/help/). Compilation is a simple process, but obviously takes more effort than just restoring a library.

However, it would seem to me that your shop must have a process (probably a form) to request a new library. A development library generally isn't of interest to auditors. My experience is with JSOX, the Japanese version of SOX (we were a USA subsidiary of a publicly traded Japanese company). The auditors (a major USA company) never were interested in our development libraries. Their main concern was that developers could not change production code or production data and that users could not get a command line. I generally found them not to be unreasonable, as long as you didn't try to circumvent them. Your colleague may be on the right track.

Sam

On 8/5/2015 8:19 AM, Dan wrote:

Developers don't have authority to restore or even create libraries at the
shop I just started in. So, in order to get the ISPHERE library installed,
I need to submit a request to the auditors for their approval.

I'm wondering if anyone has a template I can use. I'm not intimately
familiar with SOX, but I imagine they'll be raising flags on this for the
open source, because, you know, auditors.

A colleague suggested mentioning that it is a development tool for
technical use, and no end users will ever use this library.

Ideas?

- Dan