Ask the Expert

Examples of Sarbanes-Oxley violations

The Sarbanes-Oxley legislation is difficult to understand since the language is so vague. In your opinion, what would a typical violation look like? How are companies going to be prosecuted for violations and lack of security?

    Requires Free Membership to View

Sarbanes-Oxley contains many features, but there are two that stand out from an IT security perspective.

First, Sections 302(a)(4) and 404 require a public company and its top officers to make disclosures and certifications to the Securities and Exchange Commission regarding the company's system of internal controls. Internal controls cover an enormous range of methods and procedures that an organization employs to ensure it is using resources as intended, preventing fraud, protecting assets from damage and waste and so on. Among those methods and procedures are IT security techniques to thwart hackers, viruses, criminals and other pests that might abuse the organization's IT infrastructure (degrade its performance, use it to steal money, transform it into a clandestine spam mill, etc.). One way a violation might occur would be for the company, the CEO and the CFO to disclose to the SEC essentially "we have been diligent and thorough in pursing control and security over our IT resources," when in fact the company was handling IT security and control in a slipshod way. Evidence of slipshoddiness would typically not be any single problem or event, but rather be a series of shortcomings that add up to indicate poor performance. For example, such a series of shortcomings might include

  • A history of Trojan break-ins that caused leakage of high-profile company trade secrets.
  • A spate of incidents in which hackers hijacked company servers to launch distributed denial of service attacks.
  • Lack of documentation showing that upper management had regularly reviewed and supported the company's IT security apparatus.
  • Failure to hire competent IT security staff or to provide resources commensurate with the challenges of safeguarding the company's infrastructure.

For Ben's complete response, click here.

None of Mr. Wright's statements on are legal advice for any particular situation. If you need legal advice, you should consult a lawyer.

For more resources on this topic, visit these resources:
  • Information Security magazine: Security at the CEO's doorstep
  • Best Web Links: Law, public policy and standards
  • Ask the Expert: Defining "internal controls" under Sarbanes-Oxley

    This was first published in February 2004

  • There are Comments. Add yours.

    TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

    REGISTER or login:

    Forgot Password?
    By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
    Sort by: OldestNewest

    Forgot Password?

    No problem! Submit your e-mail address below. We'll send you an email containing your password.

    Your password has been sent to: