Identity Management and Sarbanes-Oxley (SOX, Sarbox) solutions are affiliated
in more than one way. The more traditional way is observing how Identity
Management technologies can address the legislator guidelines around financial
data accountability, accuracy, and auditability.
The main requirements can be summarized as "adequate internal control around
financial reporting" which includes:
1. Protecting financial information
2. Controlling the accessibility of financial information
3. Maintaining auditability of the internal control process
4. Monitoring and auditing financial information accessibility in real time as
well as periodically
5. Making sure that users access permissions to financial data are added and
removed in a timely manner
6. Making sure that these controls are applied to all systems associated with
financial or business transactions and not only to the traditional financial
systems
It is clear that Identity Management solutions, and mostly user provisioning
tools, can address a few of these challenges, including numbers 2,4, 5, and 6.
However no Identity Management solution is capable of solving the main problems
associated with financial controls, which include resolving Segregation of
Duties (SoD) conflicts, analyzing potential SoDs in real time before
provisioning new roles, and providing mitigating controls for existing
violations.
We think they are complementary and here is why:
-
- Once the analysis phase is
completed, new roles and access permissions should be provisioned to the users.
These provisioning processes normally involve complex approvals and
notification phases, and access to multiple target systems in order to create,
modify or delete the required roles. The SOX compliance tools are very good at
roles and SoD analysis, but are weak at workflow management, reverse
synchronization, and integration with multiple target systems, etc. Developing
these capabilities into the SOX tools can prove to be expensive, lengthy, and
painful. However, these functions are natural to user provisioning solutions
and can be easily and quickly deployed.
-
- Sarbanes-Oxley
(SOX) projects cost a lot and generate no return on investment (ROI). User
provisioning projects cost less and deliver real-world business value and ROI.
Combining the two projects creates a situation where the SOX compliance costs
are reduced, and due to the automation introduced by the user provisioning
software, the organization starts to see a return on investment (ROI) and is
able to address their critical compliance issues.
To learn more contact us
|