Terry Simpkins, the IT manager at
Measurement Specialties, used the HP 3000 newsgroup to announce a
respite from some of the Sarbanes-Oxley strain. An SEC document at www.sec.gov/info/accountants/
stafficreporting.htm "says the ISIT 'General Controls' are
not automatically part of section 404 testing. It's buried in Section
F of the [document], but the key phrase is, 'For purposes of the
Section 404 assessment, the staff would not expect testing of general
IT controls that do not pertain to financial reporting.' "
Simpkins, whose March report to us
chronicled 60-hour work weeks overwhelmed with SOX audit issues,
added that "If you don't know about section 404 testing, or are
not involved in your company's SOX testing, go home tonight and be
Simpkins has been sharing what he's learning as he pushes his
organizations, which rely on HP 3000s and MANMAN ERP software,
through SOX compliance. Auditors have wanted to know how companies
handle the segregation of MANMAN programming functions (testing vs.
production) to become Sarbanes-Oxley compliant. One- or
two-person shops have been struggling to show auditors how this isn't
a risk. Management review of high-level system manager capabilities
is key, Simpkins says.
"SOX states that you have to be 'in control'," he said,
"and that can be defined lots of ways. What we have done is say
that we are aware of the issue, but because of the small size of the
staff, having 'perfect' segragation of duties just isn't
"So I created a control that calls for a periodic review by
the CFO of exactly who has the 'sys mgr' capabilities. I have created
a 'log' of what users have access to the 'sys mgr' logon/capability,
and I review this list with [the CFO] quarterly. He signs off on the
list each quarter, as a record of the review."
SOX compliance has been slowing HP 3000 shops from migrating. In
particular, shops that need to give broad access to a single
administrator are struggling to maintain their processes in the face
of SOX audits. One site manager said she's lost her AM and OP
capabilities from production accounts, "so trying to get onto a
restricted box to look at a problem is...um....er...not so nicely
achieved. We've tried to explain what damage this can (and will)
do," said Carol Darnell, an IT manager at a very large HP 3000
installation, "but compliance appears to be more critical than
being able to support our customers."
Foreign companies and those with market caps of less than $75
million recently got an extension of one year to comply. Instead of
meeting the requirements by next month, these
"non-accelerated" companies now can work until July 15,
2006 - less than six months before HP turns off its 3000 and MPE/iX
support business. An article at the
IT Compliance Institute explains the extension. The site also has
a useful summary white paper of the SOX requirements.