IT Management Reference Guide

In response to several recent accounting scandals and other concerns of the consuming public, the United States congress and state legislators passed a series of laws to place greater governance on corporations. Lawmakers passed dozens of bills to address these concerns. This article discusses three of these laws that had particular impact on IT organizations. These were the Sarbanes-Oxley Act, the Graham-Leach-Bliley Act and California State Senate Bill SB 1386, shown in Table 1.

Table 1: Key Legislation Passed in Response to Major Corporate Scandals

Sarbanes-Oxley Act

If there is one single act of United States legislation that is known for its direct response to the various scandals of the early 21^st century it is the Sarbanes-Oxley Act. The name comes from the sponsors of the legislation who were Senator Paul Sarbanes (Democrat-Maryland) and Representative Michael G. Oxley (Republican-Ohio). The law is also known by its longer name of the Public Company Accounting Reform and Investor Protection Act of 2002 or by its more common shorter name of SOX. The numerous corporate scandals caused a decline of public trust in accounting and reporting practices, and SOX was intended to restore that trust. The Enron scandal was not the only impetus behind this law but it certainly served as its catalyst. The law passed overwhelmingly on July 30, 2002 with a House vote of 423 to 3 and a Senate vote of 99 to 0.

The Act contains 11 titles, or sections, ranging from additional corporate board responsibilities to criminal penalties, and requires the Securities and Exchange Commission (SEC) to implement rulings on requirements to comply with the new law. Figure 1 lists some of the other major provisions of SOX. Two of the more controversial parts of SOX are sections 302 and 404.

Section 302 mandates that companies establish and maintain a set of internal procedures to ensure accurate financial reporting. The signing officers must certify that such controls are in existence and are being used, and within 90 days of the signing have evaluated the effectiveness of the controls.

Table 2: Major Provisions of SOX

Section 404 requires corporate officers to report their conclusions in the annual Exchange Act report about the effectiveness of their internal financial reporting controls. Failure of the controls being effective, or of the officers reporting on the controls, could result in criminal prosecution. For many companies, a key concern is the cost of updating information systems to comply with the control and reporting requirements. Systems involving document management, access to financial data, or long-term data storage must now provide auditing capabilities which were never designed into the original systems.

The financial reporting processes of most companies are driven by IT systems, and the Chief Information Officer (CIO) is responsible for the security, accuracy and reliability of the systems that manage and report on financial data. Systems such as enterprise resource planning (ERP) and customer relationship management (CRM) are deeply integrated with the processing and reporting of financial data. As such, they are intertwined with the overall financial reporting process and fall under the requirement of compliance with SOX. Many companies now require not only the CEO and CFO to sign-off on SOX compliance reports, but CIOs as well. Several CIOs have begun delegating down into their staffs by having subordinate managers also signing off on SOX reports. Many of the processes discussed in this book, such as availability, production acceptance and security have direct bearing on SOX compliance.

Other countries have now begun instituting SOX-like legislation to prevent the type of accounting scandals experienced in the Untied States. For example, CSOX is the Canadian version of SOX. In line with Sarbanes-Oxley, South Korea has begun debating the establishment a separate, regulatory body similar to the PCAOB. Foreign countries doing business with American companies have learned it is prudent to be both knowledgeable and compliant with SOX provisions.

Graham-Leach-Bliley Act

The Graham-Leach-Bliley Act, also known as the Financial Modernization Act, regulates the sharing of personal information about individuals who are doing business with from financial institutions. The law requires financial companies to inform their customers about the company's privacy policies and practices, especially as it relates to non-public information (NPI). Based on these policies and practices, customers can then decide whether or not they want to do business with the company.

Non-public information (NPI) pertains to the private, personal information of an individual not readily available in public records. Customers typically disclose such information to private or public companies to transact business. Examples of NPI are social security numbers, unlisted telephone numbers and credit card accounts.

The law also gives consumers limited control over how financial institutions will use and share the personal information of consumers. It does this by requiring a financial company to offer consumers an 'opt-out' clause. With this clause consumers can choose whether or not they want to have their personal information shared with other companies. If consumers elect to exercise their opt-out clause, the financial institution with whom they are doing business cannot share their personal information with any other organization.

SB 1386

SB 1386 is also known as California Senate Bill 1386. It requires that any business, individual or state agency conducting business in the state of California disclose any breaches of security of computerized non-public information (NPI) to all individuals with whom they conduct business. Because of the large numbers of companies that process and store NPI of customers, this law has far-reaching effects. It also places a high premium on the security processes used by IT to ensure the likelihood of such a breach is kept to an absolute minimum. The law also means information systems must be readily able to contact all customers on a moments notice should a compromise to NPI occur.

If a bank, for example, unintentionally discloses the credit card number of a customer, the bank must disclose to all of its customers the nature of the security breach, how it happened, the extent of exposure and what is being done to prevent its reoccurrence. This very scenario happened to Wells Fargo bank in 2003. Sensitive customer the CEO of the bank sent out a letter to the bank's tens of thousands of customers explaining what happened, how it happened and what is being done to prevent it from happening again.

References

• http://en.wikipedia.org/wiki/Sarbanes_oxley
• http://www.consumerprivacyguide.org/law/glb.shtml