Information Security News: Sarbox compliance seen as positive

[InfoSec News <alerts () infosecnews org>]

http://www.itweek.co.uk/financial-director/features/2197518/sarbox-compliance-seen-positive-3420913

By David Rae
Financial Director
30 Aug 2007

UK companies coped well with the first year of Sarbanes-Oxley compliance 
and are even beginning to see some business benefits of adopting the 
onerous regulation.

Despite this, compliance with the requirements of the Act has still been 
a costly and time-consuming experience, according to a survey carried 
out by PricewaterhouseCoopers: Sarbanes-Oxley One Year On Evaluating 
experiences with Sarbanes-Oxley, which sought the views of more than 
one-third of all UK-based foreign private issuers registered with the 
SEC.

The research into the 22 FPIs found that respondents were generally 
quite positive about the adoption of Sarbox, claiming it had led to 
greater awareness of financial controls and led to wider benefits such 
as process and control improvements.

Despite the positive aspects, however, more than three-quarters of 
respondents reported an excessive number of key controls and 
documentation. More than one-third said they had tested more than 2,000 
key business process controls.

There are clear indications that significant progress is still required, 
said Helen Nixseaman, a partner in the risk assurance division of PwC. 
In particular, the main opportunity to streamline year-two efforts lies 
in a greater use of a top-down approach to focus on key controls and in 
how companies interpret new US guidance. This top-down risk-based 
approach is proving a real challenge.


____________________________________
Attend HITBSecConf2007 - Malaysia 
Taking place September 3-6 2007 featuring seven tracks of technical 
training and a dual-track security conference with keynote speakers 
Lance Spitzner and Mikko Hypponen!  -  Book your seats today! 
http://conference.hitb.org/hitbsecconf2007kl/