A Framework for Integrating Sarbanes-Oxley Compliance into the Systems Development Process

Abstract

The Sarbanes-Oxley Act introduces a new set of requirements into software development. Corporations need to assess their internal control effectiveness for business processes to show compliance with the act. This paper proposes a conceptual framework for integrating Sarbanes-Oxley compliance needs into software development by mapping the activities of an established framework for internal controls to the various workflows of the systems development process. Theoretical and practical contributions are discussed and future research directions are explored.

A process model for implementing information systems security governance

“…This directs our research to its second proposition -ISG is initiated using a risk-based approach. Since, determining the effective management of risk is part of IT governance (Solms, 2005), the IT governance structure must be designed so that IT adds value to the business and IT risks are mitigated (Mishra & Weistroffer, 2007).…”

Information Technology Auditing: A Value-Added IT Governance Partnership between IT Management and Audit

“…Table 5 illustrates IT strategic risks and controls objectives for the two of the 34 COBIT High Level Objectives (Process Descriptions): Plan and Organize (PO)1 -Define a Strategic IT Plan; and PO6 -Communicate Management Aims and Direction [ITGI 2007a]. See Mishra and Weistroffer [2007] for more details on COBIT. Using Audit Documentation to Improve Operational Efficiency through Business (and IT) Process Reengineering or Improved Business Process Management.…”

“…For example, the Sarbanes-Oxley Act of 2002 (SOX) requires CEOs and CFOs of large, publicly traded organizations in the United States to personally certify their organizations' financial statements. Per the Act [see Liedtka 2007, andMishra andWeistroffer 2007 for more details], these officers are responsible for designing, establishing, and evaluating the internal controls necessary to produce accurate financial statements. These financials are, in turn, significantly dependent on the information systems used in the organization.…”

Modeling process-related RBAC models with extended UML activity models

“…The demand to ensure that runtime process instances comply with modeling-level processes and policies becomes even more pressing with recent laws and regulations such as the Sarbanes-Oxley Act (SOX), the Health Insurance Portability and Accountability Act (HI-PAA), or the Basel II Accord. For example, adequate support for the definition and enforcement of process-related access control policies, including separation of duty constraints, is one important part of SOX compliance [13,18,52]. Moreover, corresponding compliance requirements also arise from security recommendations and standards such as the NIST security handbook [55], the NIST recommended security controls [56], the ISO 27000 standard family [29][30][31] (formerly ISO 17799), legally binding agreements such as business contracts, or company-specific (internal) rules/ regulations.…”