Mick Andrus
6th January 2005, 00:26
I want to start a conversation to see how other Baan-using companies are responding to the Sarbanes-Oxley requirement to document how user accounts are controlled and audited. (At least I assume all other SOX-inflicted companies are being asked for this.)
We have struggled with this question for over a year. We just finished our first annual-cycle audit and while the auditor will let us pass they were quite openly unhappy with our practices.
What they want is definitive evidence that we a) review user accounts for potential controls conflicts and b) we document these reviews. We have done a) often in the past, we have not done b) in a manner they find acceptable.
Our only suggestion on the table is very burdensome - prepare packages of user setups for management review. Our management rejected this approach rather ferociously. But it was the only approach the auditors seemed to like.
Under the rejected method, we would audit each user at least once a year. Three hundred-plus Baan users means 5-6 users per week. That means 5-6 review packages distributed to operational managers who can't tell an General Item Data record from a hole in the ground.
Now - quite honestly I don't blame them. I don't like it myself but it was the only method we could find that kept the auditors calm. But our management is not calm and will not accept it.
So - the question for conversation is, what are other companies doing? What are you doing?
(Oh, and the auditors won't tell us what others are doing. We've asked point blank and they've refused point blank to tell us.)
We have struggled with this question for over a year. We just finished our first annual-cycle audit and while the auditor will let us pass they were quite openly unhappy with our practices.
What they want is definitive evidence that we a) review user accounts for potential controls conflicts and b) we document these reviews. We have done a) often in the past, we have not done b) in a manner they find acceptable.
Our only suggestion on the table is very burdensome - prepare packages of user setups for management review. Our management rejected this approach rather ferociously. But it was the only approach the auditors seemed to like.
Under the rejected method, we would audit each user at least once a year. Three hundred-plus Baan users means 5-6 users per week. That means 5-6 review packages distributed to operational managers who can't tell an General Item Data record from a hole in the ground.
Now - quite honestly I don't blame them. I don't like it myself but it was the only method we could find that kept the auditors calm. But our management is not calm and will not accept it.
So - the question for conversation is, what are other companies doing? What are you doing?
(Oh, and the auditors won't tell us what others are doing. We've asked point blank and they've refused point blank to tell us.)