White Papers for Sarbanes-Oxley (SOX)

Sarbanes - Oxley Section 404: BMC Software Solutions to Address General IT Control Requirements

BMC Software

The Sarbanes-Oxley Act of 2002 will have a significant impact on IT organizations. In accordance with
Sarbanes-Oxley (Sarbox), executives must attest to the adequacy and effectiveness of their internal
controls, including IT controls. Internal financial process controls and related IT controls will be
externally audited, and a statement of control, including material weaknesses found during the audit,
must now appear in annual reports filed with the Securities and Exchange Commission (SEC).

In preparation for a Sarbox audit, companies must identify their significant financial accounts, the
business processes that support those financial accounts, and the applications and IT systems that
support those business processes. Then they must document and test controls at the financial
process level, the application level, and the IT infrastructure level.

The process of identifying and documenting controls may reveal the need to remediate gaps – and a
company may need to change some of its IT operations to demonstrate effective internal IT controls
relating to financial reporting processes. People may need to change roles, new IT processes may
need to be established, or new technology-based solutions may need to be implemented to
demonstrate consistent controls.

Although Sarbox does not mandate technology or software-based controls, such controls may ease
the compliance process by delivering a cost-benefit equation that is superior to manual or paperbased
solutions. Auditors will be looking not only for process consistency, but also for the consistent
application of controls over those processes. For this reason, auditors may well be wary of manual or
paper-based processes in large or distributed organizations, since an audit trail would be difficult to
establish. In many cases, software solutions are the best way to automate controls and enable the
required consistency.

View the White Paper

Share or bookmarklet this web page at: