SOX, COSO, COBIT Timeline Committee of Sponsoring Organizations of Treadway Commission (COSO)– 1985 Control Objectives for Information and Related Technology (COBIT) -1992 Sarbanes Oaxley Act (SOX) – 2002

COSO Corporate financial scandals lead to Treadway Commission (National Commission on Fraudulent Financial Reporting) James Treadway – past commissioner of SEC Five accounting organizations include Financial Executives International (FEI) American Accounting Association (AAA) American Institute of Certified Public Accountants (AICPA) Institute of Internal Auditors (IIA) Institute of Management Accountant (IMA)

COSO Control Objectives Operations – Assuring that the company is operating effectively as a business and protecting the assets of the shareholders Financial reporting – Assuring that the financial statements of the company are produced in accordance with Generally Accepted Accounting Principles (GAAP) Compliance – Assuring that the company is in compliance with relevant laws and regulations, including SEC rules, health and safety laws, and tax laws.

COSO Control Components Control environment (company culture) Risk Assessment Control procedures (control practices including corporate policies, procedural guidelines for each type of risk, etc.) Information and communication Monitoring

COBIT Information Systems Audit & Control Association (ISACA) issued COBIT (Control Objectives for Information and Related Technology) in 1996 Definitions of control closely paralleled COSO 34 IT processes Framework for IT governance and IT controls (i.e., governance and controls for IT processes) Focuses on information criteria (i.e., effectiveness, efficiency, confidentiality, integrity, availability, compliance, reliability)

COBIT Framework COBIT Definition of Internal Control The policies, procedures, and organizational structures designed to provide reasonable assurance that business objectives will be achieved and that undesired events will be prevented or detected and corrected. COBIT Supports IT governance IT is aligned with the business IT enables the business and maximizes benefits IT resources are used responsibly IT risks are managed appropriately

Benefits of COBIT Better alignment based upon a business focus An understandable view of IT for management Clear ownership and responsibilities General acceptability with third parties and regulators Shared understanding among all stakeholders based on a common language Fulfillment of the COSO requirements for the IT control environment

COBIT Processes High-level control objective Process descriptions describing process objectives Waterfall: process goals, metrics, practices Process maps to information criteria, IT resources, IT governance focus areas Detailed control objectives Management guidelines: RACI (Responsible, Accountable, Consulted and/or Informed) Maturity Model (across industry)

COBIT Process Domains : IT Activities Plan and Organize (PO) Acquire and Implement (AI) Deliver and Support (DS) Monitor and Evaluate (MF)

IT Resources Applications Information Infrastructure People

Performance Measurement IT goals and metrics that define what the business expects from IT and how to measure it Process goals and metrics that define what the IT process must deliver to support IT’s objectives and how to measure it Activity goals and metrics that establish what needs to happen inside the process to achieve the required performance and how to measure it

Other Frameworks ISO 2000 Information Technology Infrastructure Library (ITIL) – a framework of best practices to achieve efficiencies in IT service Management Global application Like COBIT, based on processes Best practices for service management

Components of ITIL SERVICE DELIVERY SERVICE SUPPORT Capacity management Availability management Financial management for IT services Service-level management IT service continuity management SERVICE SUPPORT Incident management Problem management Configuration management Change management Release management Service desk function

COBIT and ITIL ITIL complements COBIT in the area of Delivery & Support Focuses on Clearly defining service levels Helps more accurate infrastructure sizing Provides discipline in internal or external sourcing of IT services Efficiency through standardized processes