The risks associated with accurate reporting are not far removed from the risks identified in industries governed by GLBA and HIPAA. IT security risks are nondiscriminatory and apply equally to banks, financial institutions and medical facilities as well as educational organizations, manufacturing and transportation.
Many IT shops look to a risk-assessment framework from the ISO 17799 standard; 17799 treats IT security as a business issue and covers all the familiar topics, such as system operation and maintenance, backup and restore, document handling and data integrity. Beyond that, many of the same solutions that satisfy GLBA and HIPAA--specifically, policy-management packages, log analyzers and change-control procedures--can apply to Sarbox to assert and monitor controls over financial reporting systems.
Many vendors are updating their products or announcing new ones aimed to comply with Sarbox. For example, Oracle and PricewaterhouseCoopers developed Internal Controls Manager, which works with Oracle's
E-business suite. And Plumtree Software, with HandySoft Corp., released Accelerator, which brings business-process software to Plumtree's portal to create and establish internal controls and reporting procedures while maintaining collaboration tools for corporate officers, directors and their auditors. These and other solutions will bring business processes in line with software logic and put them in plain view for investors' review.
Management also needs to assess the reliability of internal controls and disclose any material weakness in their financial reporting. If one or more weaknesses exist, management will not be able to conclude that the company's internal controls are effective, and this will affect the bottom line. Investors will be leery about supporting a public company without effective controls on its internal financial systems. This may require consultants and service organizations that can supply more than IT security solutions. Public companies can look to full-service consultants such as EDS, Greenwich Technology and PricewaterhouseCoopers for technology as well as financial and legal help. Other providers are vying for a growing market to advise and consult enterprises on IT and government regulations. An example is PeopleSoft's bid to acquire J.D. Edwards.