Tom Ptacek yet again presented a really good opinion
on how ineffective SOX is being implemented into organizations. From personal experience the external auditors are trivializing and in most cases putting way to much emphasis on documentation rather than allowing IT Security professionals to focus on actual key risk areas.
Personally, they should start with financial controls and THEN analyze the impact of IT and the underlying financial system infrastructure as the external first start with IT and then work their way into business process controls thereby leaving CIO's big glaring issues that their organization has significant issues as they've streamlined their organizations and have assigned multiple roles to developers and administrators to reduce their overall IT costs.
And lets not even forget that with the Final 4(tm) organizations many of them are pulling inexperienced CPA's straight from college slapping a senior title to charge more and giving them a checklist to evaluate an organization's overall approach to security and development...
Additional articles that are linked within his blog entry:
Washington Post article
Actual PCAOB article
And here's the new guidance.
No comments:
Post a Comment