The
Sarbanes Oxley, SOX Act
The Sarbanes-Oxley, SOX Act of 2002: Key Sections
SEC, EDGAR, PCAOB, SAG
The Act and its interpretation by SEC and PCAOB
PCAOB Auditing Standards:
Reports used to Validate SOX Compliant IT Infrastructure
Documentation Issues
Sections 302, 404, 906 and the three certifications
Sections 302, 404, 906: Examples and case studies
Management's Responsibilities
Committees and Teams
Material Weakness
Is it a Deficiency, or a Material Weakness?
Reporting Weaknesses and Deficiencies
Public Disclosure Requirements
Companies Affected
Internal Controls - COSO
Internal Control
The Control Environment
Risk Assessment
IT Controls
IT Controls and Sarbanes Oxley Act Relevance
Program Development and Program Change
Layers of overlapping controls
COSO Enterprise Risk Management
(ERM) Framework
Is COSO ERM needed for compliance?
COSO AND COSO ERM
Internal Environment
Objective Setting
COBIT - the framework that
focuses on IT
Is COBIT needed for compliance
COSO or COBIT
Corporate governance or financial reporting
The Framework
The 34 high-level control objectives
What to do with the 318 specific control objectives
How to use COBIT for Sarbanes Oxley compliance
The alignment of frameworks
COSO and COBIT
COSO ERM and COBIT
ITIL and COBIT
ISO/IEC 17799:2000 and COBIT
ISO/IEC 15408 and COBIT
COSO, COBIT and Sarbanes-Oxley Sections 302 and
404
Scope of Sarbanes Oxley
Project
Software and Spreadsheets
Is software necessary?
Is software needed?
When and why
Selection process
Development Lifecycle Controls
Third-party service providers
and vendors
Redefining outsourcing
Outsourcing services and Sarbanes Oxley compliance
Outsourcing after Sarbanes Oxley
Sarbanes Oxley and other compliance projects
European answer to SOX
Integrating SOX IT security with other regulations
Aligning Basel II operational risk and Sarbanes-Oxley
404 projects
Common elements and differences of compliance
projects
Auditing in the USA and in UK: Very important
differences |