Sox Framework

Oracle ERP/CRM Corp Performance Mgmt SAP ERP/CRM Microsoft ERP/CRM Staff Augmentation Enterprise Network Bus. Proc. Outsource Financial Management App. Rationalization SOX Framework

Core Service Offerings Management Team Careers Locations Contact Us

You are Here: Home > Services > SOX Framework

Building a Compliance Framework

Today, having wrestled the first Sarbanes-Oxley (SOX) compliance period to the ground through brute force, many companies are now grappling with the realization that his is a permanent change in their business. That’s why company leaders are turning to BPO Systems to implement best-practices frameworks such as ITIL, CMMi, and Six Sigma to automate their Sarbanes-Oxley compliance activities.

Sarbanes-Oxley Process and Control Frameworks

A structured, framework-based approach to implementing compliance solutions can help mitigate implementation issues and create an infrastructure that can be used in other areas of the business.

Sarbanes-Oxley requires companies to adopt and declare a framework used to define and assess internal controls. Two control frameworks have emerged as foundational to the compliance efforts and have been adopted by a majority of companies:

COSO, primarily for financial processes, is an integrated framework providing specific guidance on implementing and maintaining internal controls. Endorsed by the SEC, COSO is the most widely adopted company-wide control framework.
COBIT™, or “Control Objectives for Information and related Technologies,” is an IT framework that maps to COSO (COSO offers little detail for IT controls)

In addition, IT process frameworks such as ITIL (IT Infrastructure Library) and CMMi (Capability Maturity Model Integrated) assist in achieving compliance by facilitating the adoption of mature, effective processes on which to impose the control framework. ITIL adoption is increasing rapidly, driven by compliance concerns.

Sustainable compliance with Sarbanes-Oxley means the death of “ad-hoc” IT processes. The Sarbanes-Oxley Section 404 affirmation requirement spans all processes that affect the business cycle of the company and any software applications used to support those processes, directly or indirectly. It also requires that these processes be effectively controlled.

Section 404 includes three control categories:

Company-Level controls (or Entity Controls), including enterprise policies, corporate governance, and information sharing
Application Controls for both financial/ERP systems and specialized applications, covering such areas as segregation of duty, authorization, validity, and accuracy
IT General Controls, governing program development, program changes, computer operations, and access to programs and data.

BPO Systems Factoid:

Initial compliance costs are minimal compared to the ongoing compliance efforts, if a structured framework is not adopted

Privacy Policy

Section 404 includes three control categories:

Company-Level controls (or Entity Controls), including enterprise policies, corporate governance, and information sharing

Application Controls for both financial/ERP systems and specialized applications, covering such areas as segregation of duty, authorization, validity, and accuracy

IT General Controls, governing program development, program changes, computer operations, and access to programs and data.