White Papers for Sarbanes-Oxley (SOX)

Implementing Mainframe IT Controls for Sarbox Compliance

BMC Software

The Sarbanes-Oxley Act of 2002 (Sarbox) significantly impacts IT organizations — specifically Section 404. According to Section 404, companies must prove the adequacy and effectiveness of their internal financial reporting controls. When reporting to the Securities and Exchange Commission (SEC), company information must now outline:
> Internal financial reporting control framework used by management
> Management’s assessment of the effectiveness of the internal controls
> Disclosure of any material weaknesses found by an external auditor

Sarbox compliance costs can be overwhelming. Gartner Research recommends that 20 percent of IT budgets be allocated for Sarbox compliance. According to Forrester Research, Section 404 compliance costs are far higher than expected. In 2004, the average large business spent more than US$10 million for Section 404 compliance. This is an especially bitter pill for corporate executives because the cost of compliance does little to positively affect the corporate bottom line.

Mainframes, which continue to run many business-critical applications, are at the center of compliance initiatives. Fortunately, mature technology and well-documented processes give the mainframe significant advantages. Existing mainframe solutions, acquired for other business purposes, can actually help achieve Sarbox compliance.

Before acquiring tools specifically for Sarbox, mainframe-centric users should take an inventory of existing database and systems management solutions. Existing solutions often can be used to ensure that IT systems and processes pass the scrutiny of compliance auditors. Alternatively, it may be advisable to replace an existing solution w ith comparable software also provides valuable compliance benefits. Both approaches can significantly lower the overall cost of compliance.

View the White Paper

Share or bookmarklet this web page at: