GRC Journal - (Page 34) SEGREGATION OF DUTIES AND COMPLIANT USER PROVISIONING A WHITE PAPER PROVIDED BY Legislators in virtually every nation have promulgated laws that mandate higher levels of corporate governance, risk management, and compliance. From the Sarbanes-Oxley Act (SOX) in the U.S., to Bill 198 in Canada, to Japan’s Financial Instruments and Exchange Law (the so-called J-SOX), the current regulatory environment worldwide is one that demands enterprises take every step to ensure the integrity of their finances, data, processes, and employees. Central to this is the need to control access to corporate information, functions, and processes, and to ensure that there is comprehensive Segregation of Duties (SoD) across the entire enterprise and at all levels of corporate functioning. Unfortunately, for many companies the cost in money and resources to ensure compliance with access control, SoD, and compliant user provisioning on an ongoing basis can be overwhelming. In fact, for companies that have a multitude of software solutions and applications, this task may seem to be virtually impossible. Establishing and maintaining a comprehensive and consistent library of SoD policies and rules, provisioning new and transferred employees, and adding new rules as functions, duties, and responsibilities change are difficult challenges for any enterprise. Even companies that have deployed access control or risk management solutions find it can be extremely difficult to translate the business definition of a particular risk into a technical definition of that risk that the solution will understand. To address these key business challenges and ensure SOX compliance consistently year after year in a sustainable fashion, forward-looking companies are seeking enterprise-ready GRC solutions. From the perspective of an executive and business process owner, an enterprise-ready solution must empower employees to do the right things, while enforcing things are done right. The solution must enforce accountability and enable transparency so that business owners and executives can ultimately sign-off on their attestations with confidence. As a result, compliance issues such as access control, proper SoD, and compliant provisioning must be managed by a solution that should span all core business processes and across all enterprise application software. A central policy repository can then ensure consistency across the enterprise. From an IT perspective, this enterprise-readiness translates into a number of requirements. First and foremost, IT managers want an application delivered with a pre-defined best practice library of comprehensive cross-process and cross-application policies. On one hand, this vast number of policy rules must be easy to enhance and to adjust as the business changes. On the other hand, rules must be granular enough to address all of the details of enterprise application software, catching all the violations without producing false positives. Second, the solution must empower employees across the enterprise. Efficient and effective collaboration between business and IT is one of the keys to success here. Automation and dynamic workflow options not only ensure reliability and repeatability of the solution by avoiding manual errors and establishing institutional knowledge, they also accelerate processes and increase efficiency. Third, the solution must be able to demonstrate compliance across the enterprise. It must maintain auditable records that internal and external auditors as well as regulators can use to verify compliance. Some relevant audit questions in the access control area include: Who has access to a given system? What authorizations do they have? Who granted access and when? Was it properly approved? Fourth, to satisfy the needs of the IT department, the solution must have a scalable, robust, and open software architecture, and be a solution that fits into any given IT system landscape. The solution should provide a range of extensibility options to meet unique business process or IT requirements. Finally, the solution must meet enterprise performance and scalability requirements. 8 BTQ Business Trends Quarterly Q1 2007 | www.btquarterly.com http://www.btquarterly.com
For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.