The Sarbanes-Oxley Act of 2002, often referred to as SOX, was a legislative response to the accounting scandal caused by the recent fall of some publicly-held companies and the perceived excesses of the management of some other companies.
Sarbanes-Oxley requires compliance with a comprehensive reform of accounting procedures for publicly-held corporations to promote and improve the quality and transparency of financial reporting by both internal and external independent auditors.
The following websites provide additional information about the Sarbanes-Oxley Act of 2002 and how it impacts the way many companies must now conduct business:
As detailed below, PCK Technical Services has experience developing technical documentation to help companies comply with the Sarbanes-Oxley Act of 2002, specifically Section 404, general application controls and general computer controls.
- Provided project management/technical writing services to comply with the Sarbanes-Oxley Act of 2002, Section 404 (general application controls and general computer controls). This entailed documenting both application development services and operations documentation for six systems involving indirect lending, direct lending, servicing, accounting, general ledger and data warehousing.
- Conducted interviews and meetings with senior management, system project managers, system developers/leads, business users, and personnel in application development, QA, operations, help desk, training and accounting departments.
- Walked through systems and existing documentation, performed gap analysis, and identified and documented all inbound or outbound system interfaces, data flows, data classifications, encryption levels, SLAs and automated/batch processes (including Visio process diagrams).
- (Triad) Created operation run guides for batch processes, report run guides, user guides, development guides, and other system documentation.
- (Triad) Created a set of standardized system documentation that allows auditors to review all system-related documents via hyperlinks. The system description document included a system overview, interface details (frequencies and encryption information), file/table names, data descriptions (e.g., manual input forms/processes, screen displays, data files, data dictionaries, database structures/relationships, field names/descriptions, data transfer procedures, functional specifications, batch interface processes, application entry guidelines, output reports), program source code libraries, and system control documentation. The system processing document (operations) included processing instructions and timing, post-processing data control procedures (review procedures and verification tests/procedures), and output files and reports.
- (Aames) Identified and documented inbound/outbound interfaces for over 30 systems (legacy and third-party) including table/field/file names, frequencies, technical specifications, flow diagrams and job names.
- (Encore) Created legacy system (Empower) interface Operations and Help Desk guides to comply with the Sarbanes-Oxley Act of 2002 including system infrastructure, process flows, data transfer/mapping details, system installation, backup, recovery, maintenance and monitoring, user accounts, escalation, and troubleshooting/contact information.
- Implemented corporate change control/change management procedures for related docs utilizing Visual Source Safe or other internal processes.
- Worked at accelerated pace to meet tight documentation deadline within budget.
- Helped create a standardized set of system management and project management documentation for application/system/database implementation, enhancements, risk assessment, maintenance and support.
- Provided project management, technical writing and business analysis services to comply with Sarbanes-Oxley Action of 2002, Section 404 (specifically, general application controls and general computer controls).
- Reviewed resources, existing internal documentation, audit findings/controls assessment, best practices/industry standards, CobiT, COSO and other references.
- Created standard operating procedure template, numbering/naming conventions and standards for future documentation.
- Reviewed environment, organization, systems, team roles and responsibilities, job descriptions, corporate intranet, network directories/folders and files.
- (State Street/Aames): Conducted interviews with management, technology leads and staff in the IT departments such as Application Development, DBA, Network Administration (system access/user administration), Network Operations/NOC (including system monitoring, escalation, backups, shutdown/startup, disaster recovery), Network Engineering (infrastructure installation, configuration, maintenance and security, data center operations), Help Desk (hardware/software procurement, installation, support and asset management), and QA/CM (change control and configuration management including change requests, testing, approvals, emergency change requests, application migration/security between test, development and production environments, and risk assessment).
- (Aames): Conducted interviews with management and staff in corporate departments including Accounting, Admin. Services, Appraisal QC, Capital Markets, Credit, Funding, HR, Internal Audit, Legal, Loan Management, Loan Services, Operations, Quality Assurance, Sales and Treasury.
- (Fannie Mae): Worked with directors and managers of several business centers across various regions of Fannie Mae's single family business to identify, receive and coordinate source materials/content from subject matter experts in functional areas including business development, marketing, underwriting, customer management, risk management, counterparty management, servicing, legal and others.
- Created operational policies and procedures including procedures to support business continuity and disaster recovery plans.
- Conducted gap analysis for missing documentation.
- Researched and provided central documentation library/management system recommendations and temporary Access/VB database solution.
- Provided project management services for ongoing documentation review, edit and approval process.
|
