Like other public companies that handle credit cards, Alviso, Calif.-based TiVo faces a double whammy: meeting the requirements of the Sarbanes Oxley Act and the Payment Card Industry data security standard. Through a savvy combination of proactive auditor relations, automation and simplification, however, the company has cut significantly the time and effort it spends dealing with compliance issues.

Read about TiVo’s disaster recovery plan

“We’ve saved two-thirds of the time and one-third the effort we used to expend dealing with audits,” says TiVo Director of IT Richard Rothschild, who spoke at the recent Network World IT Roadmap Conference & Expo in Santa Clara, Calif. “And that can only get better as time goes on.”

View a podcast of our interview with TiVo's Richard Rothschild from IT Roadmap.

Getting out in front

A key strategy for TiVo is to be more proactive during audits. Rather than waiting for the auditors to tell Rothschild’s staff what they need, the staff and relevant business managers sit down with the auditors beforehand to decide upfront what the audit should cover. “This helps us limit the scope to just what the auditors need to determine whether we’re compliant,” he says. “It avoids a lot of creep.”

In the past, auditors tended to ask a lot of questions and go down roads that led to more work but didn’t necessarily help determine TiVo’s compliance posture. By being more proactive, TiVo has eliminated such fishing expeditions. For example, a typical audit may need to test and verify the file-recovery system for a Network Appliance device. “We sit down and define exactly what the test is, what it means and how it should verify compliance,” Rothschild says. “Then everybody is clear on where we’re going to end up. It reduces the work — and the cost — for everybody.”

Once TiVo and the auditors agree on the scope, the company saves even more time and money by automating as many back-end auditing-related processes as possible. For example, a typical SOX audit requires TiVo to prove that terminated employees no longer can access its network. In the past, proving such compliance would mean checking a list of terminated employees against Active Directory, then checking VPN logs to see if any recently terminated employees had tried to log on. The process could take a couple of staff as long as two weeks.