Re: SOX monitoring and journal interpreter

I will second what Vern said. From my understanding, SOX is not really amount the nitty gritty details, just documentation. You almost have to go thru a SOX audit and see what they ask for. It has been a few years since I had to deal with one. I remember one of the things they asked for was who has QSECOFR access (not what they actually did). Another was a list of changes. We also used TurnOver, so I just had to print the list of Forms (changes) that went into Production (and not the actual objects changed). SOX auditors were happy.

If you don’t have some sort of Change Management product in place, you might want to investigate getting one. Its tracking and documentation should help with the Audits.


Thanks
Scott Johnson


-----Original Message-----
From: WDSCI-L [mailto:wdsci-l-bounces@xxxxxxxxxxxx] On Behalf Of Vernon Hamberg
Sent: Friday, October 20, 2017 7:44 AM
To: wdsci-l@xxxxxxxxxxxx
Subject: Re: [WDSCI-L] SOX monitoring and journal interpreter

Hi Darren

This depends on what "activity" means - we don't allow developers to change data on the production LPARs, so we don't have to record that kind of thing.

In a very simplistic way, I think of SOX as related to ensuring process
- how things are done.

We use Turnover change management app - it generates logs for each promotion/distribution to production - we convert these SPLFs to PDFs and store for auditing later.

 If there are changes to file formats, say, those are logged by Turnover, and Turnover takes care of preserving the data.

So it seems to me that you don't need to go at some types of file changes - you mention "actual file data" - I would think it rare that developers can even DO that.

HTH
Vern