+ All Categories
Home > Documents > IT and Financial Compliance: Closing the Gaps in Sarbanes-Oxley

IT and Financial Compliance: Closing the Gaps in Sarbanes-Oxley

Date post: 30-Oct-2014
Category:
Upload: mricky
View: 1,023 times
Download: 2 times
Share this document with a friend
Description:
 
Embed Size (px)
Popular Tags:
of 24 /24
IT and Financial Compliance: Closing the Gaps in Sarbanes- Oxley April 19, 2005 Steve Greenstein / Rudy Kiste
Transcript
Page 1: IT and Financial Compliance: Closing the Gaps in Sarbanes-Oxley

IT and Financial Compliance: Closing the Gaps in Sarbanes-

Oxley

April 19, 2005

Steve Greenstein / Rudy Kiste

Page 2: IT and Financial Compliance: Closing the Gaps in Sarbanes-Oxley

2

Closing / Explaining the Gaps in Sarbanes-Oxley

Page 3: IT and Financial Compliance: Closing the Gaps in Sarbanes-Oxley

3

About BridgeMarkBDO Seidman, LLP’s BridgeMark practice is dedicated to Risk Consulting and Advisory Services. We leverage our more than 90-year heritage as a CPA firm, entrepreneurial spirit, full service capabilities and extraordinary responsiveness to deliver value to companies throughout our local offices and our global network.

BDO Seidman• U.S. member firm of BDO International• $375 million in revenue• Over 2,100 people in 36 offices plus over 5,000 professionals in 185 alliance firm locations

BDO International• $2.9 billion in revenue• 5th largest global accounting firm in the world• Over 22,600 people in 590 member firm offices in 100 countries

Page 4: IT and Financial Compliance: Closing the Gaps in Sarbanes-Oxley

4

BridgeMark Spectrum of Services

Internal Audit – Financial, Operational and Information Technology

• Risk Assessment

• Internal Audit Transformation

• Strategic Partnering & Staffing

• Vendor, Royalty & Construction Audits

• Fraud/Forensic Investigations

• Establishment of Internal Audit Function

• Information Technology Audit

Technology Risk & Security

• Enterprise Security

• System Controls and Effectiveness

• Business Continuity Planning

• Privacy & Data Protection

• Vulnerability Analysis and Testing

• Technology & Strategy Alignment

• Change Management

Business Process Improvement

• Operational Performance Reviews

• Business Process Integration

• Financial Analysis & Modeling

• System Implementation Support

• Special Accounting Projects

• Project Management Office (PMO)

Compliance Services

• Sarbanes-Oxley Readiness Service

• Corporate Governance Assessment

• Regulatory Risks (PATRIOT, HIPAA, SAS 70, GLB)

• Human Resource Compliance

• Federal and State Regulations

Experienced in executing integrated Non-US SOX Compliance Projects

Page 5: IT and Financial Compliance: Closing the Gaps in Sarbanes-Oxley

5

Reporting Requirements

The Requirements: Key Sections 302, 404 and 409

(Appendix A)and

SEC Rulemaking

Management’sAssertion

COSO & COSO ERM,COBIT, Basel IIISO17799 and

AS/NZS 4360:1999Frameworks

PCAOB Auditing Standard No.2

Company’sAssessment Process,

Documentation and Testing

Page 6: IT and Financial Compliance: Closing the Gaps in Sarbanes-Oxley

6

COBIT Components

Page 7: IT and Financial Compliance: Closing the Gaps in Sarbanes-Oxley

7

Information Technology Compliance

Today’s Organizations are Concerned About:

• Risk Management

• Governance

• Control

• Assurance (and Consulting)

Importance of IT Compliance and integration:

• Enhances corporate accountability.

• IT plays a vital role in the internal control structure.

• Systems, data and infrastructure components, are critical to the financial reporting process.

• Develop a compliance plan that specifically addresses IT controls.

• Integrating the Sarbanes-Oxley compliance plan into the overall IT plan.

Page 8: IT and Financial Compliance: Closing the Gaps in Sarbanes-Oxley

8

BridgeMark Can Add Value By:

• Financial and IT experience in performing integrated off-shore and Non-US SOX Compliance projects.

• Defining risk tolerances where none have been identified, based on experience, judgment, and consultation with management.

• Reviewing critical control systems and risk management processes.

• Performing continuous reviews and evaluation on the effectiveness of management's risk assessments and internal controls.

• Providing advice in the design and improvement of control systems and risk mitigation strategies.

• Implementing a risk-based approach to planning and executing compliance processes to ensure that resources are directed at those areas most important to the organization.

• Challenging the basis of management’s risk assessments and evaluating the adequacy and effectiveness of risk treatment strategies.

Page 9: IT and Financial Compliance: Closing the Gaps in Sarbanes-Oxley

9

Non-US BridgeMark SOX Compliance Projects

Examples of Financial and IT experience of off-shore and foreign location SOX Compliance Projects:

• UK

• Scotland

• Israel• Thailand

• Japan• Korea

• Mexico

• Panama

• Brazil

• Argentina

• Dominican

Republic

• France

• Germany

• Belgium

• Italy

Page 10: IT and Financial Compliance: Closing the Gaps in Sarbanes-Oxley

10

COSO Components

Monitoring

• Assess control system performance over time

• Ongoing and separate evaluations

• Management and supervisory activities

Control Activities

• Policies that ensure management directives are carried out

• Approval and authorizations, verifications, evaluations, safeguarding assets security and segregation of duties

Control Environment

• Sets “tone at the top”

• Foundation for all other components of control

• Integrity, ethical values, competence, authority, responsibility

Information and Communication

• Relevant information identified, captured and communicated timely

• Access to internal and externally generated information

• Information flow allows for management action

Risk Assessment

• Identify and analyze relevant risks to achieving the entity’s objectives

Page 11: IT and Financial Compliance: Closing the Gaps in Sarbanes-Oxley

11

The COSO ERM Framework

Entity objectives can be viewed in the context of four categories:

ERM considers activities at all levels of the organization:

• Enterprise-level

• Division or subsidiary

• Business unit processes

The eight components of the Framework are interrelated …

Page 12: IT and Financial Compliance: Closing the Gaps in Sarbanes-Oxley

12

Compliance & Information Technology Governance

Building a strong internal control program:

• Enhances overall IT governance

• Enhances the understanding and importance of IT among executives.

• Improves business decisions with high-quality, more timely information.

• Aligns project initiatives with business requirements.

• Prevents loss of intellectual assets.

• Minimizes the possibility of a system breach.

• Gaining competitive advantages through more efficient and effective operations and processing integrity.

• Enhances risk management competencies.

• Enhances prioritization of initiatives.

Page 13: IT and Financial Compliance: Closing the Gaps in Sarbanes-Oxley

13

Relationship to Internal Control - Integrated Framework

A strong system of internal control is essential to effective enterprise risk management:

• Expands and elaborates on elements of internal control as set out in COSO’s control framework.

• Includes objective setting as a separate component. Objectives are a prerequisite for internal control.

• Expands the control framework’s “Financial Reporting” and “Risk Assessment.”

Page 14: IT and Financial Compliance: Closing the Gaps in Sarbanes-Oxley

14

Our Approach to SOX Compliance

BridgeMark’s comprehensive approach is designed to help companies meet the requirements under Section 404 of the Sarbanes-Oxley Act.

Engagement Management

Organizeand PlanProject

Phase I

Corporate-Level

Control Assessment

Phase II

Process-LevelControl

Assessment

Phase III

Testing, Reporting & Continuous Monitoring

Phase IV

Phase I Deliverables:

Project team organizational chart

Project team roles and responsibility matrix

Preliminary significant accounts and process matrix

Project plan (includes project timeline, responsibilities and milestones)

Phase II Deliverables:

Documentation of general controls over key technology systems

Corporate-level control assessment and recommendations for improvement

Final significant accounts, processes and transaction stream matrix

Updated project plan

Phase III Deliverables:

Process maps for significant processes

Matrix of all key risks and related control points

Assessment of the design of controls and recommendations for improvement

Phase IV Deliverables:

Summary of critical findings

Updated control matrix reflecting procedures performed, results of such procedures and assessment of risks

Documentation of all detailed testing

Page 15: IT and Financial Compliance: Closing the Gaps in Sarbanes-Oxley

15

Key Process Derivation & Financial Statement Coverage

1. Determine Significant Accounts at the Financial Statement Level.

2. Map General Ledger Accounts to Significant Processes.

3. Determine Material Reporting Units (PCAOB Release No. 2003-17).

4. Map Processes and Sub-processes to Material Reporting Units - significant account balances.

High-level summary

YesSummaryLow

SummaryYesLimitedMedium

DetailedYesComprehensiveHigh

Process Narrative

Risk/Control Matrix

Level of Documentation

Process Rating

High-level summary

YesSummaryLow

SummaryYesLimitedMedium

DetailedYesComprehensiveHigh

Process Narrative

Risk/Control Matrix

Level of Documentation

Process Rating

H

M

L

Page 16: IT and Financial Compliance: Closing the Gaps in Sarbanes-Oxley

16

General and Application Controls

Page 17: IT and Financial Compliance: Closing the Gaps in Sarbanes-Oxley

17

General and Application Controls

• Designed to ensure financial information generated from the Company’s application systems can be relied upon via:• Data Center operations controls

• Access security controls

• Application systems developments and information infrastructure implementation and maintenance controls

• Support the functioning of application controls to help ensure accurate information processing and the integrity of the resulting information used to managed.

Page 18: IT and Financial Compliance: Closing the Gaps in Sarbanes-Oxley

18

Assessing IT Controls

Understanding IT Controls

Roles and Responsibilities

Based on Risk

Monitoring and Techniques

Assessment

Importance of Controls

Page 19: IT and Financial Compliance: Closing the Gaps in Sarbanes-Oxley

19

IT Audit Structure and Controls

Assess

IT

Controls

Understanding IT Controls

Governance, Management, Technical

General / Application

Preventative, Detective, Corrective

Information Security

Importance of IT Controls

Reliability and Effectiveness

Competitive Advantage

Legislation and Regulation

Roles and Responsibilities

Governance

Management

Audit

Based on Risk

Risk Analysis

Risk Response

Baseline Controls

Monitoring and Techniques

Risk Control Matrices

Frequency

Assessment

Methodologies

Audit Committee Interface

Page 20: IT and Financial Compliance: Closing the Gaps in Sarbanes-Oxley

20

On-Going Compliance / Continuous Monitoring

EffectiveEffective

GovernanceGovernance

Page 21: IT and Financial Compliance: Closing the Gaps in Sarbanes-Oxley

21

Visit us in Booth 21 and Contact UsFinancial / Operations / Sales

Steven Greenstein

Sr. Customer Relationship Director

212.885.8074

[email protected]

Rudy Kiste

Engagement Manager

212.885.8400 x:5261

[email protected]

Information Technology

David Smokler

Director

212.885.8077

[email protected]

Lily Shue

Senior Manager

201.788.2323

[email protected]

Page 22: IT and Financial Compliance: Closing the Gaps in Sarbanes-Oxley

22

Sarbanes-Oxley, Some Key Provisions (Appendix A)

• Sarbanes-Oxley Act of 2002

• Expands reporting requirements and accountabilities – requires CEO and CFO attestations/filing of internal control reports with annual report (Sections 302 & 404).

• External auditors will be required to attest to and report on management’s assessment in the internal controls report (Section 404).

• Disclose to public on a “rapid and current basis” material changes to financial condition or results of operations (Section 409).

• Empowers audit committees (Section 407).

• Requires disclosure regarding code of ethics (Section 406).

• Creates new oversight for external auditors, mandates audit partner rotation and establishes audit firm rotation study (Sections 203 & 303).

• Increases civil and criminal penalties.

Page 23: IT and Financial Compliance: Closing the Gaps in Sarbanes-Oxley

23

General Controls (Appendix B)

• Administration - planning and controlling IT activities

• Logical Security Controls - access control

• Accounting Systems Development - application system development life cycle

• Accounting Systems Change Management - change control and authorization

• Packaged Software Evaluation - maintenance of software packages

• System Software - development and maintenance of infrastructure support software

• Data Center/Network Operations - backup, recovery and contingency planning, job scheduling, performance and monitoring

Page 24: IT and Financial Compliance: Closing the Gaps in Sarbanes-Oxley

24

Application Controls (Appendix C)

• Controls embedded within software programs to prevent or detect unauthorized transactions.

• Controls that ensure the completeness, accuracy and validity of processing transactions.

Examples of application controls:

• Balancing control activity within the system

• Check digits

• Predefined data listings

• Data reasonableness tests

• Logic tests, range limits, etc.


Recommended