Ask the Expert

Internal audits for Sarbanes Oxley and internal IT support

My COO just told me that per SOX rules, only an independent, third-party vendor can access our servers. I have been accessing and configuring them for years under SOX and he claims that our auditors just indicated that an internal IT administrator is not allowed to access them whatsoever, not even to change a user's password. This sounds ridiculous to me. Does SOX really restrict who can administer certain systems?

    Requires Free Membership to View

It sounds like somewhere along the way there has been some miscommunication. Certainly only an independent, third-party auditor can provide the final assessment of the company in order to meet the requirements of the SOX certification process, but there is nothing in the law that says only third-party vendors can access your systems.

However, a huge part of the SOX 404 requirements revolve around whether a company has documented processes and procedures and how well it follows them. So if your company has policies in place that limit who can access critical systems (and they must have such policies under SOX) it is possible that those policies have recently changed to include only a particular third party. This is not as crazy as it seems if there was a recent outsourcing of IT services.

However, it is just as likely that somewhere along the line there was a misunderstanding when someone conflated the ideas of system configuration and system assessment. I encourage you discuss this in more detail with your COO and make sure you are both on the same wavelength.

About the author:

This was first published in January 2009

There are Comments. Add yours.

 
TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to: