MAKING SENSE OF SARBANES-OXLEY TOOLS
The application of automated tools to the
Sarbanes-Oxley effort has several implications for company processes beyond
compliance with the act. In many companies, for example, Sarbanes-Oxley projects
represent the first time business process
owners have been required to take genuine
accountability for their controls. Increased
attention to control issues, combined with
the technology’s information gathering
and data management capabilities, may
lead to overall improved business processes
and facilitate sharing of best practices
throughout the organization. Furthermore,
companies may use Sarbanes-Oxley as the
impetus for an enterprise risk management
program, rather than only focusing on
financial reporting risks.
LANGUAGE INDEPENDENCEGiventhat Sar- The new software tools may also
banes-Oxley applies to countries outside encourage companies to conduct more
North America, some firms may require robust analyses of their processes than ever
their software to operate in foreign lan- before. The data collected on risk and con-guages to accommodate non-English trols can be analyzed for trends, best prac-speaking users. Some tools offer multiple tices, and areas that may merit increased
language support “out of the box,” thereby organizational focus. Furthermore, appli-side-stepping the expense of translation. cation-controls testing will be under addi-
“control portals” that allow organizations
to summarize all of their risk, control, and
data analysis in one unified location.
OPERATING PLATFORM One of the easiest
ways to ensure cross-platform compatibility is to work with tools that operate
via a Web browser. This way, the end-user machine needs only a browser to
access the application.
When evaluating platform-specific
products, auditors should check with their
information systems department to ensure
the platform is fully supported by the
company’s existing infrastructure. Auditors may also want to consider working
with an open-source software code to
allow for in-house product maintenance.
tional scrutiny, potentially leading to
improved analysis of company databases.
This, in turn, could result in improved
organizational business intelligence, cost
recovery, and fraud detection savings.
For the short term, however, many
firms are turning to the technology for
its immediate ability to help manage
Sarbanes-Oxley projects, which, by itself,
can be a formidable task. Prospective buyers can easily become overwhelmed by the
vast number of products currently offered
and, in the confusion, focus only on near-term objectives. The best purchase decisions, however, will likely result from
keeping both immediate and long-term
goals in mind and considering what the
tools may be able to accomplish beyond
compliance with Sarbanes-Oxley.
The author’s opinions are solely his own and
do not necessarily represent the policies or
positions of his employer.
To comment on this article, e-mail the
author at firstname.lastname@example.org.
FEBRUARY 2004 INTERNAL AUDITOR