This IT Audit approach is not the approach taken in an IT General Controls SOX Project.  Sarbanes Oxley is the assessment of controls over financial reporting. It assumes that controls would provide assurance of accurate financial reporting.  SOX does not validate the accuracy of financial statements.  This is the objective of the Financial Statement Audit.

   In regards to security parameter settings, SOX Control Activities need to be designed to provide assurance that the security parameters would always be set correctly.  It is not a one time validation of the parameter which would be the approach of a traditional IT Audit.

The control objective for the example discussed previously would be

“Logon Security parameters are defined and are continuously monitored to ensure they are to set to prevent an unauthorized takeover of IDs”

The control activities would include the following:

- OS Configuration checklist are established which specify key security related system configuration requirements

- OS Configuration checklist are completed prior to the rollout of new production domains

- Audit Trails are enables and a review process occurs which would detect changes to security parameters

- Annual validation to ensure compliance with configuration checklists occurs for sample number of servers

   When designing the SOX tests for all of these control activities, none of the tests would consist of checking the value of the security parameter which would be the case for a traditional IT General controls audit.  Even the test for the annual validation to ensure compliance with configuration checklists would only assess whether the validation process occurred but not validate the results of the review.

   In conclusion, SOX Controls and testing focuses on the establishing control activities to ensure a desired value where IT Audits would check the value.  SOX requires IT Auditors to reorient their approach when establishing and testing SOX controls

For a free proposal to perform an audit of your organization or provide SOX support & testing services, contact Mitchell Levine of Audit Serve at (203) 972-3567 or via e-mail at Levinemh@auditserve.com.