1. Analysis of Sarbanes-Oxley and IT Control: Robert Freeman

2. 2 Agenda Introduction The Origins of Sarbanes-Oxley and IT Auditing Examining IT Governance Controls Creating Value Assessing Trust Conclusion

3. 3 The Origins of Sarbanes-Oxley and IT Control Sarbanes-Oxley was passed in July, 2002 to correct problems of internal control in both accounting and IT areas. Created the PCAOB, as well as further requirements on management. Code of Ethics required, but still comes from corporate attitude. History of IT control stems from Equity Funding Corporation of America scandal, 1973. CobiT 4.1 latest version of internal control.

4. 4 Examining IT Governance Controls Utilizing document of controls from the IT Governance Institute. Important Objectives: Understanding the organization’s internal control program and its financial reporting process. Identifying risks related to these IT systems, designing and implementing controls designed to mitigate the identified risks and monitoring them for continued effectiveness. Monitoring IT controls for effective operation over time.

5. 5 IT Control Road Map Source: http://www.inforica.com/consult-compliance.html

6. 6 Examining IT Governance Control Types of Controls Entity-Level Controls useful on a macro scale. Activity-Level Controls good for accounting applications, such as the general ledger. Road Map Important for measuring scope, formalizing the process. Critical for long-term sustainability of IT control implementation. Human Factor Change of culture must begin from top-down.

7. 7 Creating Value Sarbanes-Oxley must be able to foster trust, confidence, compliance, and improve company value. Negative Has increased company expenses by 130%, hurt small businesses. Positive Has encouraged change in controls, culture. Companies are creating greater returns on value through improved IT governance structures.

8. 8 Assessing Trust Trust and confidence between parties is important for greater returns from market. Negative Investors want to see positive returns, regardless of status of company’s internal process control. Positive Companies are improving controls, not “racing to the bottom”. Quantity and quality of financial information to investors has improved.

9. 9 Conclusion IT will continue to grow in importance as a means of communication and control. Sarbanes-Oxley is a good start, but not enough. Companies must create value through change in culture, and improvement in controls in all departments, including IT (increased flexibility). Compliance is not enough to create value.

10. 10 Questions