IT Portfolio Management Step-by-Step: Unlocking the Business Value of Technology

3.8. APPENDIX 3A Sarbanes-Oxley Compliance Road Map

1. Plan and Scope: Gain an understanding of how the financial reporting process works and identify where technology is critical in the support of this process; key systems, subsystems.

2. Perform Risk Assessment: Performed for systems supporting the financial reporting process—for example, quality and integrity of information managed by IT systems, access controls, authorizations, availability and timeliness of information, recoverability controls, and so on. The probability and impact of possible failures at various locations, within business units, and so on, is critical.

3. Identify Significant Controls: Identify significant accounts and relevant application controls. Application controls are business processes designed within an application to prevent/detect unauthorized transaction, ensuring completeness, accuracy, authorization, and validity of processing transactions. Companies should assess the controls that support the quality and integrity of information.

4. Document Controls: Documentation is a unique aspect to the Sarbanes- Oxley compliance process and for many companies will present significant challenges. A company should document its approach to IT control, encompassing the assignment of authority and responsibility for IT controls as well as their design and operation.

5. Evaluate Control Design: Evaluate the ability of the company's ...