Sarbanes Oxley Certified Professional

The Sarbanes-Oxley Act (SOX) was enacted in July 2002, largely in response to large public failures of corporate governance. Securities and Exchange Commission's (SEC) rulings is that Internal Controls must assure the secure, stable, and reliable performance of computer hardware, software, and SOX personnel connected to financial systems.

Course Synopsis:

The Sarbanes Oxley, SOX Act

The Sarbanes-Oxley, SOX Act of 2002: Key Sections SEC, EDGAR, PCAOB, SAG
The Act and its interpretation by SEC and PCAOB
PCAOB Auditing Standards:
Reports used to Validate SOX Compliant IT Infrastructure Documentation Issues
Sections 302, 404, 906 and the three certifications
Sections 302, 404, 906: Examples and case studies
Management's Responsibilities
Committees and Teams
Material Weakness
Is it a Deficiency, or a Material Weakness?
Reporting Weaknesses and Deficiencies
Public Disclosure Requirements
Companies Affected

Internal Controls - COSO

• Internal Control
• The Control Environment
• Risk Assessment
• IT Controls
• IT Controls and Sarbanes Oxley Act Relevance
• Program Development and Program Change
• Layers of overlapping controls

COSO Enterprise Risk Management (ERM) Framework

• Is COSO ERM needed for compliance?
• COSO AND COSO ERM
• Internal Environment
• Objective Setting

COBIT - the framework that focuses on IT

• Is COBIT needed for compliance COSO or COBIT
• Corporate governance or financial reporting
• The Framework
• The 34 high-level control objectives
• What to do with the 318 specific control objectives
• How to use COBIT for Sarbanes Oxley compliance

The alignment of frameworks

• COSO and COBIT
• COSO ERM and COBIT
• ITIL and COBIT
• ISO/IEC 17799:2000 and COBIT
• ISO/IEC 15408 and COBIT
• COSO, COBIT and Sarbanes-Oxley Sections 302 and 404

Scope of Sarbanes Oxley Project

Software and Spreadsheets

• Is software necessary?
• Is software needed?
• When and why
• Selection process
• Development Lifecycle Controls

Third-party service providers and vendors

• Redefining outsourcing
• Outsourcing services and Sarbanes Oxley compliance
• Outsourcing after Sarbanes Oxley
• Sarbanes Oxley and other compliance projects
• European answer to SOX
• Integrating SOX IT security with other regulations
• Aligning Basel II operational risk and Sarbanes-Oxley 404 projects
• Common elements and differences of compliance projects
• Auditing in the USA and in UK: Very important differences