However, a huge part of the SOX 404 requirements revolve around whether a company has documented processes and procedures and how well it follows them. So if your company has policies in place that limit who can access critical systems (and they must have such policies under SOX) it is possible that those policies have recently changed to include only a particular third party. This is not as crazy as it seems if there was a recent outsourcing of IT services.
However, it is just as likely that somewhere along the line there was a misunderstanding when someone conflated the ideas of system configuration and system assessment. I encourage you discuss this in more detail with your COO and make sure you are both on the same wavelength.
About the author:
- Find out more about SOX and email archiving.
- Read about strategies that can improve security and audit relationships.
Dig Deeper on IT security audits and audit frameworks
Related Q&A from David Mortman
While IT security consultancies can be helpful when trying to find flaws in an information security management framework, there are ways to do it ... Continue Reading
PCI DSS audits can be a lot easier if the scope is narrow. Learn how to consolidate and store sensitive data in order to best reduce PCI DSS security... Continue Reading
When hiring an information security team member, how important is a certification in information security? Learn how to talk to executives about ... Continue Reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.