Big4Guy

Information technology has today become the backbone of all enterprises. Most big businesses have a software, ERP, or other applications which support the achievment of business objectives. As part of Sarbanes Oxley and Section 404, management needs to have comfort on the controls working within and around such applications. One important set of controls includes access controls relating to such applications. One pertinent question here would be "Who has access to sensitive transactions or data?".

So how does the management approach the situation. A process should be in place to periodically review how, by whom and how frequently sensitive transactions were accessed. Ideally, it is the application and data owners who should undertake these reviews. Application and data owners should periodically undertake such reviews based on the sensitivity and criticality of transactions. The entire purpose of such a review would be to ensure that individuals with a real business need are authorized to execute critical and sensitive transactions. Such review would normally reveal situations where improper access has been given. Such execptions should be handled by removing access to the personnel with unauthorized access. As a best practice, users access to sensitive transactions as well as IT systems in general should be in line with their job roles.

Related Posts

Effect of Material Weakness on Financial Statements
Documentation for Section 404 Compliance
Identifying Significant Processes - Sarbanes Oxley
IT Governance for Sarbanes Oxley