Home » Data Protection » PCI and Compliance

In Depth

How to Learn to Love Sarbanes-Oxley

Embracing new Sarbanes-Oxley requirements can provide benefits to your security program and your business.

By David Bowser, Information Systems Security Manager, Kennametal

Page 3

By doing this, you not only keep your staff compliance-motivated but you'll avoid questions from the auditors, who would frown upon late or incomplete documentation. The first thing they'd say is, You committed to semiannual analysis, but we see no evidence to support that you did that.

5 Keep in touch with auditors and peers.

Yes, we're starting year two of SOX compliance, but in a way the process is ongoing. We've tried to keep the relationship with the auditors going. If they're in town, we'll go to lunch and tell them about our progress. We ask them what they're seeing out in the field and what are the trends to be aware of. I also like to pick the brains of other people. I'll ask peers about their experiences. It doesn't take long to do and you can learn really useful things by just asking.

6 Accept and absorb the up-front costs.

Looking at it now, I think the cost of SOX compliance is front-loaded. A huge amount had to happen in year one, and it required a significant investment. But the opinion here, especially within risk management, audit and security, is that if we discount any dollars spent, we really believe SOX has improved the way we handle important issues like change control, security and operations.

But what about the expense, right? Even if it improved the company, was it worth it? I think that over time we'll find it was well worth it. Some companies are trying to spend less up front, just making sure they're compliant; they try to spread the expense out over time. Others are willing to make the required commitments sooner rather than later. We were the latter. We really wanted to be outstanding, so we made the investment in year one. And I think, going into year two, the cost curve will be dramatically different for managing IT controls.

7 Enjoy the efficiencies you create.

In fact, I believe the efficiencies SOX helps us create will easily justify the cost we've put into SOX compliance. I see a strong correlation between efficiencies and SOX. It's helping us run lean. It's forcing us to review our processes and take out the waste. So, will we be SOX compliant? Yes, we believe so. We'll also be far more efficient and effective, and, while technically that's an ancillary benefit to SOX compliance, it's the kind of benefit that I want to put front and center with our management.