1

I’m in the Service Desk at a large, recently publicly traded company that is going through a lengthy SOX audit. This is uncharted territory for most of us. One of our new requirements when creating/modifying system access is to take a screenshot of what was modified. Is this really a best practice? I get the importance of tracking these changes, but I feel there has to be a better way to track this information, at least in some of our systems. Is this necessary, are our auditors blowing smoke?

I’m sure Active Directory and SAP would be the easiest to figure out, however we also have multiple AS400s, EnView/RedPrairie/JDA, web portals, the list goes on.

Any suggestions or advice would be greatly appreciated.

6 Spice ups
2

I’m no SOX expert but there has to be a better/more efficient way than taking a screenshot. Needs to be automated.

Following for future use. Good luck!

3

Also no specific SOX knowledge, but I agree that screenshots don’t sound like an efficient method of tracking.

I could understand making a one-time export dump of some kind (screenshots if no export function is available) to record the initial condition. After that, I would expect to see some kind of change-tracking system in place where the nature of each change (who-when-where-what-why) is recorded. This can be as simple as a spreadsheet or SharePoint table if no system designed for the purpose is in place.

4

Never had that issue at publicly traded companies that had SOX audits.

What SOX really expected was:

  1. user request comes in for access (new hire, change request for additional rights, termination etc.)
  2. approval from who ever is responsible comes is documented
  3. change is executed and documented in the ticket

What SOX then did:

  1. you had a new hire on x/x/x - show me the documentation of it
    1. often good to have an additional written paper with signatures of department managers of rights needed etc.
      1. create a template with checkboxes to mark them off
    2. scanned version attached to the ticket for new hire
  2. termination similar to new hire with
    1. written version (template/checkboxes) with signatures
    2. data was retrieved from email / local system / user-home
    3. data was archived on a defined system
    4. scanned and attached to ticket
  3. changes to rights
  4. written version (template/checkboxes) with signatures
  5. change execution date
  6. scanned and attached to ticket

Similar for backup and final data archive / long time archive while adhering company retention needs and policies - you document that the backup was checked and successful. If not, you document that it failed and what was done to correct it. Minimum weekly, but based on your company policy.

Depending on the amount of data - if you can - make sure the maximum retention policy for data is the one you follow for all data - if you need to divide it due to the sheer amount, this becomes more complicated.

What you want:

Look at a helpdesk ticketing system that lets you document all of it - categorize it as well so you can quickly find it once they ask for it.

4 Spice ups
5

This is a great post and very similar to something that I would have suggested. Well done!

3 Spice ups
6

I work for an OCC regulated bank and we have a few auditors. Let me tell you, they ALL ask for screenshots. They like reports, but they love screenshots. It seems to be standard practice with them.

7

As someone who has been involved with many kinds of audits, I can tell you that a screen-shot is NOT the only way to do it. What they are doing is recommending something they have used before and it held up in court. Yes, you can do something else. But has that something else been tested? Personally, I would use the ticketing system with approvals of department heads required.

1 Spice up