VCI Addresses Sarbanes-Oxley
By W. Lowell Putnam, President and CEO Video Communications, Inc. (VCI)
Because it requires personal sign-off by top level officers and allows them to become individually liable, Sarbanes-Oxley (SOX) has forced many companies to review all their financial systems and practices to a degree that has not been done for years, if at all. Much of this review has been done by outside auditing firms to a cost of millions of dollars in billable hours, so it is not surprising that some companies are now considering going private to save those costs. SOX also has no clear guidelines- each auditing firm interprets it differently. If you change firms, you can expect that the new firm will find a new set of compliance issues that the other did not.
Most SOX compliance issues are much more about business practices than about system functionality. Some of these are standard control practices that should already be in place such as separation of duties. For example, log reconciliation should not be done by the people who produce the log (Traffic) or those who aired it (Operations), but by someone in another area - - typically Accounting.
Because SOX is all about audit trails, it is important that your systems (software and otherwise) have appropriate journal files showing when financial changes occurred within the system. A key point that is often missing is where information comes out of one system and goes into another. VCI has extensive journaling and therefore the impact on us in terms of required changes has been small.
In general, the major points pertaining to SOX are:
It is expensive to go through an initial audit to show compliance and you will have to do it every year, although subsequent audits should be less expensive.
It is as much about job responsibility as it is about system capabilities.
In the end you have to be able to show the who, what, when, where and why about changes to financial data.
This is only the first round, starting next year there is a new section of SOX dealing with "notification of significant financial events". Anyone want to define those words?
Are you reading this from a forwarded email?
