GRC Journal - (Page 90) Governance, Risk & Compliance THE IMPERATIVE FOR IT COMPLIANCE In response to the SarbOx fallout, IT organizations of many large enterprises have scrambled to inventory their processes, assess their maturity, and develop a way of measuring potential risk. High-quality business systems have been developed, and heroic attempts have been made to plug control gaps with manual spreadsheet-based processes. But these somewhat arbitrary methods tend to collapse under the intensive scrutiny of today’s severe internal and external audits. CIOs must prove that their systems work as expected, that controls are in place to avert risk, and that system management is transparent enough to enable auditors to examine processes and controls directly and easily. Otherwise, corporations will fall short of SarbOx requirements and face penalties in the form of fines from the U.S. Securities and Exchange Commission. ‘Point’ solutions are not the answer Why has IT become the Achilles’ heel in corporate governance? One theory is that when SarbOx came into play, it was only expected to apply to assessments of general computer controls, as defined by auditing standards. Unfortunately, it proved more far-reaching than that, impacting the assessments of all processes supported by central IT systems, and the controls around those systems — particularly security and change management — were inconsistent because they were historically performed manually. Companies lacked any coherent “systems of record” that could consistently support key processes and related information in order for auditors to produce reliable results. This doesn’t mean IT did not invest software to support the auditing process; quite the reverse. In the first year after SarbOx 404 came into effect, a host of independent software vendors released compliance management programs that automated documentation, testing, evidence gathering, and auditing. According to IDC, many forward-looking enterprises brought in change and configuration management tools, to close control gaps. Other companies invested in developing automated processes to better support SarbOx 404 testing, evidence, and audit requirements*. born out of a private-sector effort in 1985 to examine the symptoms of fraudulent financial reporting and recommend prevention tactics. Since then, two major sets of guidelines have emerged in the IT arena: CobiT and ITIL. CobiT comes from the IT Governance Institute, formed in 1998. Now, CobiT version 4.0 contains a six-step maturity model that identifies the areas where enterprises can assess and improve IT governance, and support regulatory requirements as well as operational efficiency. SarbOx 404 control assessments reveal that most IT organizations have yet to reach steps four or five, where systems oversee processes automatically; most enterprises are still at step three where most processes are still defined, measured, and monitored manually. Adoption of CobiT has been slow; the more broadly accepted approach is ITIL, which stems from the British Office of Government Commerce and the British Standards Institute. ITIL is a library of best practices that can be used to define and monitor processes in five areas: service-level, capacity, availability and IT financial management, and contingency planning. IDC observes that although ITIL was first invented to improve IT service quality, it also offers “a thorough framework for defining, measuring, and managing IT infrastructure*.” IDC believes guidelines, such as ITIL (for best practices) and CobiT (for defining and assessing IT controls), should be adopted by IT organizations because they can act as a springboard for best-practice-based governance initiatives*, which are upheld by “IDC believes guidelines, such as ITIL and CobiT, should be adopted by IT organizations because they can act as a springboard for best-practice-based governance initiatives, providing an outline for organizations to measure and monitor their processes, in direct proportion to the risk they pose for creating a misstatement.” In fact, more than 70 percent of companies interviewed by IDC said they have either deployed, or plan to purchase these types of solutions*. However, many of them purchased separate vendors’ compliance management software to address different points of the reporting process, creating a disconnect in the corporation’s overall view of the financial reporting schema. What’s needed, experts say, is a common and consolidated audit and reporting software package so that stakeholders in the compliance process can see into IT systems quickly and easily, and IT can proactively mitigate emerging risks, moving the company from mere compliance into a state of governance. Risk and compliance frameworks Clearly, it’s difficult to develop a corporate-wide framework that can automatically govern all IT systems without some kind of blueprint. The de facto risk and control standard for SarbOx compliance is the COSO enterprise risk management framework, findings from the Public Company Accounting Oversight Board (PCAOB), a nonprofit corporation founded to help implement SarbOx compliance. It provides an outline for organizations to measure and monitor their processes, in direct proportion to the risk they pose for creating a misstatement. Using this guidance, auditors can integrate internal controls with audits of financial statements; tailor audit plans to the risk profiles of their clients, rather than using standardized checklists; and work with their clients to design accounting and internal control systems. According to IDC, “The use of technology to close process control and information gaps is key*.” Software: The cohesive approach HP has developed its own compliance management software in response to internal concerns about IT governance, during its merge with Compaq in 2002. “As the acquisition approached, we could see the magnitude of the problem,” explains Ames. “We needed to categorize and manage thousands of IT applications, and we had to construct plans to reduce the number of systems Q3 2006 | www.btquarterly.com BTQ Business Trends Quarterly 17 http://terly.com
For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.