Big4Guy

The main purpose with which Sarbanes Oxley was enacted was to curb fraud in corporates. Fraud is one of the most major risk facing corporates today. Some of my earlier posts do touch upon antifraud controls and fraud screnarios, I have not really talked about IT based antifraud controls. IT plays a important role in todays organization. Organizations can leverage IT in their sarbanes oxley compliance plans to address fraud risks. IT based antifraud controls can be used in SOX compliance. Let me explain how It based antifraud controls can be used.

Segregation of duties in applications SOD - The basic premise of segregation of duties is that users should not be in a position to initiate and authorize their own transactions. Modern IT applications ERPs like SAP, Oracle Apps, J D Edwards, Peoplesoft can be configured based on roles. Access to specific transactions in the system can be restricted based on user roles and profiles. Segregation of duties in applications can act as a major antifraud controls and lead to better SOX compliance.

Sensitive Access Controls SAT - The other important antifraud control is restricting user access to sensitive transaction in the system. From an IT perspective users have access to a lot of information such as payroll data, balance sheet, profit and loss account etc. This sensitive information can be misused. It is therefore important to restrict users access to this sensitive information in applications. Sensitive access controls address this requirement. SATs coupled with SODs can act as the foundation for IT based antifraud controls.

Related Posts

Sarbanes Oxley IT Compliance
Sarbanes Oxley Balancing Risks and Controls
Sarbanes Oxley Record Retention