GRC Journal - (Page 91) THE IMPERATIVE FOR IT COMPLIANCE Governance, Risk & Compliance while maintaining control. It was obvious to us early on that strong IT governance was a critical requirement for making the acquisition a success.” Then SarbOx made the imperative even more urgent. Ames united his team’s control measurement and risk management efforts with HP’s OpenView systems and network management What is Sarbanes-Oxley Section 404? The Sarbanes-Oxley Act, which went into effect July 30, 2002*, states that publicly traded companies in the U.S. must disclose their internal control over financial reporting in their annual reports. A company’s internal control report must include: • A statement of management’s responsibility for establishing and maintaining adequate internal control over financial reporting for the company; • Management’s assessment of the effectiveness of the company’s internal control over financial reporting, as of the end of the company’s most recent fiscal year; • A statement identifying the framework used by management to evaluate the effectiveness of the company’s internal control over financial reporting; as change, configuration, availability, and identity management. This is important because according to Dittmar, it’s common to find several different manual change management procedures within the same company. In many departments, a spreadsheet containing tick marks might be the only evidence that progress past each checkpoint has been authorized. Automating the change management process gives auditors a visible and standard result. “When software drives the authorization process, it increases the likelihood that management and auditors can more easily determine that authorization did, in fact, occur,” says Dittmar. Deloitte and IDC evaluate HP’s answer Deloitte supplied “use cases” for HP to test OpenView Compliance Manager as it was being developed. The cases were designed to identify key control indicators that would yield useful information for managers and auditors. “HP’s use of OpenView to enable compliance is innovative,” says Dittmar. “Its focus on key indicators fits well with the focus on a risk-based approach to an effective control program. HP’s approach is in line with the compliance recommendations that Deloitte Consulting makes to our clients.” “One lesson HP learned is that ongoing compliance management is not about avoiding all risks,” says Ames. The HP OpenView monitoring systems alert auditors to “exception” trends, which telegraph emerging risks. By being able to isolate these types of trends, auditors can refocus on the high-risk areas that matter most, rather than spending their time in maintenance mode. According to IDC, HP’s extensions to OpenView are well-timed, and this compliance management product will help improve IT governance in three major ways, all of which can translate into higher ROIT*: 1) Risk avoidance through trends analysis and timely/accurate reporting - help enterprises avoid paying fines, boost customer confidence, and possibly raise their share price as a result; 2) Enhanced productivity through automation - increase staff efficiency and user productivity, improves user support and administration, and cuts downtime hours, incidents, and the percentage of users impacted; 3) Cost reduction through exception-based control and risk monitoring - frees IT resources from reactive compliance information gathering, and designed to reduce manual control monitoring and audit support, resulting in lower auditing fees. Automate to improve ROIT While it’s still early to quantify, IDC feels that automating IT governance and compliance processes will help cut costs in the long run*. IDC’s analysis has already found that since SarbOx was introduced, organizations have increased their auditing expenses by as much as 60 percent, and this number rises to 150 percent whenever a serious glitch is encountered*. As such, auditing costs can easily run into the millions of dollars for larger firms, but “the potential to save millions of dollars is realistic, particularly as organizations become more focused on key risks, as opposed to all operational processes*,” IDC notes. HP’s response demonstrates that after a tough period of assimilating many information-intensive regulations, IT suppliers and organizations are beginning to earmark solutions that cut • A statement that the registered public accounting firm auditing the company’s financial statements, included in the annual report, has issued an attestation report on management’s assessment of the company’s internal control over financial reporting. *Source: U.S. Securities and Exchange Commission, http://www.sec.gov/rules/final/33-8238.htm software group, using compliance at HP as a test bed. The resulting application, HP OpenView Compliance Manager, houses a range of sophisticated metrics and indicators that are designed to identify emerging risks, and automatically ensure that controls are in place. A key area of focus is HP’s predefined set of “key control indicators” and “key risk indicators,” which span IT controls such 18 BTQ Business Trends Quarterly Q3 2006 | www.btquarterly.com http://www.sec.gov/rules/final/33-8238.htm http://btquarterly.com
For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.