© 2014 Protiviti Inc. An Equal Opportunity Employer. Confidential: This document is for your company’s internal use only and may not be copied nor distributed to any other third party. SOX & Information Technology

© 2014 Protiviti Inc. An Equal Opportunity Employer. Confidential: This document is for your company’s internal use only and may not be copied nor distributed to any other third party. 2 SOX – IT Scoping In-scope business processes typically include the following: Entity Level Controls Equity Financial Close Fixed Assets Inventory Investment and Treasury Payroll Procure to Pay Revenue Tax *Start with the financials In-scope business processes support the line items in the financials (significant accounts) RCMs and business process maps created to document business processes, controls, and risks. The Bigger SOX Picture 2

© 2014 Protiviti Inc. An Equal Opportunity Employer. Confidential: This document is for your company’s internal use only and may not be copied nor distributed to any other third party. Identify Sources of Data Spreadsheets Reports Systems (applications) Analyze Source Complexity Purpose Number of Users 3 SOX – IT Scoping

© 2014 Protiviti Inc. An Equal Opportunity Employer. Confidential: This document is for your company’s internal use only and may not be copied nor distributed to any other third party. In-Scope Creates efficiencies Client must have or implement ITGCs around the system Process owners (and auditors) can rely on data generated by the system Out-of-Scope ITGCs not possible or challenging (Access databases) Process, financial accounts, and controls are still in-scope Process owners must perform data validation (EAE) and have a review control in place 4 SOX – IT Scoping

© 2014 Protiviti Inc. An Equal Opportunity Employer. Confidential: This document is for your company’s internal use only and may not be copied nor distributed to any other third party. IT Linkage Example 5

© 2014 Protiviti Inc. An Equal Opportunity Employer. Confidential: This document is for your company’s internal use only and may not be copied nor distributed to any other third party. 6 SOX – IT Scoping In-scope business processes typically include the following: Entity Level Controls Equity Financial Close Fixed Assets Inventory Investment and Treasury Payroll Procure to Pay Revenue Tax *Start with the financials In-scope business processes support the line items in the financials (significant accounts) RCMs and business process maps created to document business processes, controls, and risks. In-scope applications that support these in-scope business processes are identified IT General Controls (ITGCs) - pervasive IT controls that support these in- scope business processes and applications are identified and tested. Processes include: Change Management, Security, SDLC, Data Center, and Data Management IT Application Controls (ITACs) – system controls within the business process maps are identified and tested Spreadsheets relied upon or used within controls identified in the business processes are identified and tested. Reports relied upon or used within controls identified in the business processes are identified and tested. The Bigger SOX Picture 6

© 2014 Protiviti Inc. An Equal Opportunity Employer. Confidential: This document is for your company’s internal use only and may not be copied nor distributed to any other third party. Logical Security New Hires/Terminations/Transfers Access Reviews Database / OS / Application Administrators Passwords Change Management Tested/Authorized/Approved Segregation of Duties Computer Operations Job Scheduling and Access (batch/backup jobs) Physical Security 7 SOX ITGC Testing