Home » Data Protection » PCI and Compliance

How To

Sarbanes, Oxley and You

Fiona Williams, who is responsible for Deloitte & Touche's security services practice for North America, answers readers' questions about the Sarbanes-Oxley Act.

October 01, 2003 — CSO — Q: What do you see as the most direct tie between Sarbanes-Oxley and an organization's security program?

A: There are several links between Sarbanes-Oxley requirements and a company's security program. They include: ensuring appropriate awareness of company security policies and commitment by management; designing and implementing appropriate security controls; and documenting and auditing security policies, and making sure they are understood by management and end users.

Q: Sections 302 and 304 of Sarbanes-Oxley require management to establish, maintain and report "internal controls", but the Securities and Exchange Commission has not officially defined "internal controls." Are there specific sections on information security that relate to internal controls under Sarbanes-Oxley?

A: Section 404 mandates that each annual report contain an internal control report, which must state the responsibility of management for establishing and maintaining an adequate internal control structure and procedures for financial reporting. It must also contain an assessment, at the end of the issuer's most recent fiscal year, of the effectiveness of the internal control structure and procedures for financial reporting. The auditor must attest to, and report on, the assessment made by the management of the issuer.

Sarbanes-Oxley will require that companies implement an established internal control framework. As part of that framework, general computer controls will need to be implemented and documented. Infosec controls are a key component of general computer controls; without them, general computer controls and overall internal controls cannot be effective. Therefore, infosec controls are a critical component to ensure an effective COSO-based internal control environment. (Visit www.coso.org for more information on the committee.)

Q: What elements of a corporate physical security program would fall under Sarbanes-Oxley? For example, does Sarbanes-Oxley require certain levels of physical security controls in a data center or similar facility? If yes, under what section does this reference fall?

A: Physical security does fall under the Sarbanes-Oxley requirements. It is a critical component of the infosec program as well as general computer controls. It falls within sections 302 and 404, which require that management evaluate and assert that the internal controls are operating effectively.

Q: What is the approach and process to implement Sarbanes-Oxley Act Section 404? Who is the driver? Is it purely a group audit function? What is the role of IT?

A: The process for implementing Section 404 should include project management, people, process and technology, as well as various phases of implementation including scope and plan; assess and define; identify and document controls; perform tests and remediate; and monitor and certify.