Slashdot Mirror
IT Braces for 'J-SOX' Rules
jcatcw writes to mention that Japan-based businesses are prepping for new requirements, called J-SOX, similar to Sarbanes-Oxley in the United States. Even though details are not expected until next month, many IT managers are already working on implementing controls to handle the expected regulations. "Marios Damianides, an IT risk management consultant and partner at Ernst & Young LLP in New York, said he expects that the relaxation of some Sarbanes-Oxley requirements by the Public Company Accounting Oversight Board in the U.S. late last year should help ensure that the J-SOX rules won't be excessive for businesses."
I've been working on compliance for J-SOX over the last six months or so - to be honest, the actual legal requirements are so vague and broad that almost any interpretation can be said to be "in compliance".
The main thing that's come out of it is that we've had to document all procedures relating to the production systems - no more flying by the seat of your pants.
Chisox, bosox, and now jsox?
Screw this, I'm watching hockey.
There is a J-SOX* FAQ here. Note: this is a PDF. I have no affiliation w/ the company.
* "J-SOX"? I suppose it makes sense, but sounds too much like "J-pop".
I want to drag this out as long as possible. Bring me my protractor.
I just remember filling out three forms to get applications into test for SOX. In to frigging TEST! *shivers and starts rocking* I'm SO glad I got out of that!
I understand the need to track who did what and why and what the code is and all that jazz... But seriously, a year of my life was lost in that red tape...
Ask not what you can do for your country. Ask what your country did to you
The reaction to SOX here in the US has been to take companies private, or list in London instead of New York. The costs of SOX alone are easily enough to force you out of business if your competitors aren't burdened with SOX.
I'm kinda surprised that Japan would be similarly desperate to rid itself of publicly traded companies.
- Adam L. Beberg - The Cosm Project - http://www.mithral.com/
As opposed to SOX in the US, J-SOX will fit loosely and be administered by hordes of giggling Japanese schoolgirls.
To prepare I recommend this product:
http://www.holisticwisdom.com/anal-eze.htm
and start off with small plugs before going for the full-bore SOX audit.
"Where quality is like a dead stinking rat - you just can't miss it."
Lemme be the first to say that J-SOX RULES!!!
J-SOX is what they'll be calling that baseball team up in Boston if Daisuke Matsuzaka's "gyroball" has any success.
But we were hoping that better judgment would prevail. Apparently our hope was in vain. :P
Thanks a bunch Enron! Fucking douchebags ruined it for everyone, and they got a slap on the wrist.
Instead of implementing some much desired features and efficiencies in our systems, we had to jump through hoops ensuring that everything was 'audit ready'. Logs whenever data enters or leaves a system, documentation of all that, etc...
We're already dealing with J-SOX...your god help me if Europe and Asia start the same crap.
Blar.
Which is fine since 99% of "normal people" have never heard of J-Pop, and I doubt that Japanese IT professionals call it J-SOX.
Here is my personal experience with SOX, from a sales point of view.
I can't take purchase orders that are not 100% perfectly filled out. It doesn't matter if I've been doing business with that company for 20 years and they all know me. The PO is now a LEGAL document (contract) and must be completed in full before my manufacturer's will take the order. You know the criteria I am talking about -- FOB, terms, Delivery date, quoted item, a price, etc. Lots of times, with people you've been doing business with a long time, they just send over the purchase order with enough information to fill the order. But again, "enough information to fill the order" and "perfectly filled out" are not the same thing. A simple example is a customer who is picking up the item. They may not fill out the shipping method because - duh - they are picking up from us down the street. That purchase order would not be accepted. It should say "customer pickup", per SOX (not directly, but SOX requires orders/revenues to be fully documented and companies take it to extremes - like with PO's)
Now, throw in a mix of bureaucracy and attorneys arguing over terms and conditions (net 30, net 60, etc) and guess what? Nothing gets sold.
It IS happening out in the field and I can safely say that SOX is having some unintended consequences.
J-SOX? Shouldn't that be SOX.NET ?
It's a simple matter of complex programming.
We keep getting libertarian things which benefit the effete rich : legalized sodomy, lower taxes for the wealthy and globalism. Where's libertarianism for the poor man : legal prostitution and legal recreational drugs ?
I expect theirs will be more reliable, get better mileage.
for a Japanese company obviously. The thing you need to know is that the law itself is impenetrable in the US and Japan. Don't worry about it. Look for the document from COSO on internal controls (nasty - send this to the accounts department) and the COBIT framework (nice - keep this one in IT) COBIT is really really friendly and structured (34 chapters with loads of specific guidance on each), if you have been working with ISO 9000 and related things then you are going to like COBIT. COSO is woolly and unstructured, it sort of breaks down into 4 elements and J-SOX adds an extra one for IT controls, which as I understand it, probably just means that to do COSO you need to do COBIT.
Just remember when they are handing out the responsibilities:
COBIT = nice
COSO = nasty
Capitalists convincing governments to pass these laws so that it looks like the governments are actually doing something about corporate corruption- while the 10% game (only the worst 10% of cases of business fraud ever get reported, let alone prosecuted) continues on.
SJW: a person who perceives an injustice, and while correcting it, commits a greater injustice.
I work for a japanese company, so I'm really getting a kick out of these replies ... this is how bad information gets passed around.
"We returned the General to El Salvador, or maybe Guatemala, it's difficult to tell from 10,000 feet"
isn't he the one that planned to ride aboard a commerical rocket wearing a Char Aznable costume?
[quote]The lessons learned from U.S. companies' Sarbanes-Oxley efforts will lead Japan's Financial Services Agency to "soften J-SOX [requirements] a little bit," said Damianides" [/quote] Is he serious? If J-SOX works like America's SOX... they'll have the same crap results we have. You can pay one of the "big three" a mountain of cash to write up in creative ways that you comply. Done.
The intent of SOX isn't to produce compliant or verifiable environments that I can tell. It's a big stick to wield (and it gets wielded differently on a case by case basis). Everything seems to run to intent versus who did what these days. It's not whether analyst A set mail to Broker B. It's about whether or not A put B on the To/CC/BCC line (A meant to send to B), or if B got the mail through a convoluted series of DL memberships (indicating that the intent was NOT for B to receive the message).
At my current client I have to show a screen print of what the change will look like on the production server, without making the change. So I have to alter the images from my test system to look like the production system to pass SOX review.
I cannot comment on SarbOx in general. IANAL. I don't even play one on TV. But I can comment on the IT aspects.
I've been through a supposed SarbOx implementation when, as a consultant, one of our clients got gobbled up by a huge company. They had a huge list of requirements, supposedly needed for SarbOx. One in particular stuck in my mind: Passwords had to change every 45 days. They blamed Congress for this whenever I objected.
So I got a copy of the SarbOx legislation. The word "password" doesn't even *OCCUR* in the law. A bunch of other stuff didn't line up, either. When I raised these issues to their attention, I was told their expensive auditing/compliance provider said it was a requirement, while I was just an IT puke, so suck it up. (We sucked it up. At $95/hour.)
Given that some of this stuff has to be done by outside auditors, and the rest is often outsourced to same, it occurs to me that there is an incentive for the auditing houses to make things as onerous as possible. They make more money that way. I'm not saying every situation is like that. Just that money, like electricity, tends to follow the path of least resistance.
Food for thought.
dragonhawk@iname.microsoft.com
I do not like Microsoft. Remove them from my email address.
Co worker was required to collect 400 SCREEN shots of a file before and after changes to the file and paste them into the SOX document.
You see- a backup copy of the file wouldn't satisfy auditing requirements since "it might be changed".
Of course bitmaps are so much harder to change than a backup copy on a lockbox system.
INSANE INSANE INSANE.
I'm so glad i don't develop now. My job is doing these processes and helping the developers focus on the work now. I'm happy- they are universally happier. I used to be so frustrated. It had reached a point of 3 months of documenting for 1 month of development which really meant about 24 hours of coding time.
I'm sorry but I got in this job because I liked CODING and DEBUGGING. In fact, I really prefer DEBUGGING because of the constant mini "AHA"'s. I can't even keep my skills up on 24 hours of coding per 4 months.
Neither can anyone else- so the business either accepts longer projects (throw in an extra month for stale skills) or they just outsource to a contract company that DUH HAS NO SOX REQUIREMENTS (because it can do the project 5x as fast).
Ah well..
She was like chocolate when she drank... semi-sweet at first and then increasingly bitter.
Working as sys admin for an American company, I have had enough exposure to Sarbanes-Oxley to last me a while.
While I fully understand and sympathise with the need to ensure that companies don't lie as much as they would like (we should something for politicians and lawyers too, eh?), in some cases it is taken to ridiculous extremes. In my company we now have to submit all new hostnames to a security commission - these are hostnames that are allocated on an internal DNS server. Why is that? I don't understand it, but there you are.
And we are not allowed to use an external NTP server - the hole in the firewall is simply closed, and the request doesn't get through. On the other hand http is allowed through, of course - but don't tell me that the problems you can get on your machine from NTP are worse than what you import via http.
Now, I know that are many theorectical computer security issues associated with using networks, but in our case the Sarpox is simply being used as an excuse for allowing the most anal-retentive security people in the company to bully everybody. Wasn't the idea that it should be harder for people in upper management to abuse their power to strip the company of money and line their own pockets? Introducing rules that hamper the production teams in everything they do only provokes resentment and inspires people to find ways around, thus defeating the entire project and creating new, but unknown security threats. And meanwhile those in power positions, who are ethically challenged, will still be dishonest; and of course they will also just find new ways to steal, won't they?
So the real question remains - what can actually be done about the basic problem: that people in the top of companies (and indeed people in any power position) are fundamentally flawed? Looking to other countries, we can see that it is possible; the moral and ethical standards for companies in Europe are much higher than in the US.
This post is not a troll at all. The poster is simply pointing out that we're spending trillions to save billions.
We see the same thing in the UK. They want to spend hundreds of millions of pounds on ID and they say that this is to stop benefit fraud and illegal immigration. The cost of the scheme is a large multiple of the cost savings over the life of the project, but to someone, this math makes sense ?!