Just the mention of a Sarbanes-Oxley audit provokes horror stories of inordinate time spent providing evidence; complying with written policies, procedures and guidelines; and attending countless meetings. Sorry to say, but life is not going to get easier until you make SOX a part of your daily routine and take an active role in the entire audit process.

In more than 70 IT security audits and three full-scale SOX engagements at Fortune 100, 500 and 1000 companies since 2002, I have witnessed both the best and worst practices and approaches to compliance. Why is it that so many educated, driven individuals seem unable to use the numerous, readily available sources of data to stand up and challenge the interpretations of SOX to which they are subjected? Instead, they blindly accept the mandates set forth by the very people who have a vested financial interest in how the SOX audit is run.

Some knowledgeable external auditors have eliminated many controls that had to be satisfied last year. They made these changes after realizing their understanding of SOX should change to be more closely in line with the intent of the law. Other auditors are unwilling to modify the audit controls they consider critical. Often there is a direct correlation between this inflexibility and lack of real-world, hands-on experience.

Unless you and your company's audit group have a full understanding of SOX, you won't be able to question the external auditors' template of what they expect. The Web sites of the Information Systems Audit and Control Association (www.isaca.org), Institute of Internal Auditors (www.iia.com) and Public Company Accounting Oversight Board (www.pcaob.com) offer a wealth of information about SOX.

There are six major SOX pitfalls you're likely to encounter:

Too many controls selected to meet compliance. You can reduce these by having an educated understanding of what the actual law asks for.

Lack of documented policies, procedures and guidelines; poorly drafted control activities and poorly documented test procedures.

Lack of an organized internal audit-team structure. Your company needs financial and IT auditors, or you face seeking out consultants on the fly without verifying their capabilities.

Failures discovered during the initial audit but not remedied. The additional time required to fix these problems increases audit costs.

Whitepapers

• Gene Kim's Practical Steps to Mitigate Virtualization Security Risks
• Selecting Effective Virtual Directories
• A Modern Approach to On-Demand Email and Data Security
• Best Practices for HP Servers and HP Enterprise Virtual Array in a Microsoft Exchange
• Compliance, Protection, Recovery: A Layered Approach to Laptop Security
• Endpoint Security: Data Protection for IT, Freedom for Laptop Users

View more SECURITY whitepapers

Webcasts

• Key Considerations for a Successful 802.11n Deployment
• Solutions to the Toughest IT Challenges in Remote Offices
• Lowering the Cost of Email Archives
• High Availability for SQL Server 2005 Using Array-Based Replication and Host-Based Mirroring Technologies
• Technical Overview of Exchange Server 2007 with HP Servers and Storage
• Bringing Order and Security to your Mobile Workforce: Corporate Mobility Policy and Device Management On-Demand

View more SECURITY webcasts

Special Reports

• The Evolution of Network Security
• Taking Virtualization Up a Notch
• Learn how to Keep your Mobile Workforce Connected
• The self-managed network

View more SECURITY special reports