Slashdot Mirror

← Back to Stories (view on slashdot.org)

IT Braces for 'J-SOX' Rules

Posted by ScuttleMonkey on from the more-reasons-not-to-be-profitable dept.

jcatcw writes to mention that Japan-based businesses are prepping for new requirements, called J-SOX, similar to Sarbanes-Oxley in the United States. Even though details are not expected until next month, many IT managers are already working on implementing controls to handle the expected regulations. "Marios Damianides, an IT risk management consultant and partner at Ernst & Young LLP in New York, said he expects that the relaxation of some Sarbanes-Oxley requirements by the Public Company Accounting Oversight Board in the U.S. late last year should help ensure that the J-SOX rules won't be excessive for businesses."

9 of 57 comments (clear)

  1. Comment anonymous for obvious reasons... by Anonymous Coward · · Score: 1, Interesting

    I've been working on compliance for J-SOX over the last six months or so - to be honest, the actual legal requirements are so vague and broad that almost any interpretation can be said to be "in compliance".
    The main thing that's come out of it is that we've had to document all procedures relating to the production systems - no more flying by the seat of your pants.

    1. Re:Comment anonymous for obvious reasons... by qwijibo · · Score: 4, Interesting

      Is that any different than the US? Everything I've seen about Sarbox is so vague that anyone can claim compliance if they have paid consultants enough money. The large bank I work for has a bunch of people who try to ensure that we're doing everything by the book, while management considers violating all of the rules to be a sport. It's always fun to have a large group of people telling you that you can be fired for failing to do things right when your management lets you know that if you do things by the book, you'll fail to meet your goals and will be fired. It's a life sized Dilbert cartoon. =)

    2. Re:Comment anonymous for obvious reasons... by boxless · · Score: 2, Interesting

      Yeah, I reall think the vagueness is the worst part. Then it all comes down to what kind of company you work for, and what kind of IT department you have. If they are the controlling type, then the vagueness will lead them to slow things down to a crawl, all under the heading of compliance. It is an extremely frustrating thing to watch and participate in. Up is down. Black is white.

      If you have a more flexible group, then the vagueness might help.

    3. Re:Comment anonymous for obvious reasons... by ContractualObligatio · · Score: 2, Interesting

      The other side to the problem, bizarrely, is that it is too detailed. By which I mean, the financial guys didn't really have many rules for the IT department, and now they do.

      Which leads to your point i.e. Great, they've added a layer of detail by requiring IT to be "compliant", but it's so vague *within* that layer it's a nightmare.

      I've heard they might be talking about getting rid of the IT controls from SOX entirely and just letting companies get on with it.

  2. Flashbacks by techpawn · · Score: 2, Interesting

    I just remember filling out three forms to get applications into test for SOX. In to frigging TEST! *shivers and starts rocking* I'm SO glad I got out of that!
    I understand the need to track who did what and why and what the code is and all that jazz... But seriously, a year of my life was lost in that red tape...

    --
    Ask not what you can do for your country. Ask what your country did to you
  3. Bye Bye public companies... by Duncan3 · · Score: 4, Interesting

    The reaction to SOX here in the US has been to take companies private, or list in London instead of New York. The costs of SOX alone are easily enough to force you out of business if your competitors aren't burdened with SOX.

    I'm kinda surprised that Japan would be similarly desperate to rid itself of publicly traded companies.

    --
    - Adam L. Beberg - The Cosm Project - http://www.mithral.com/
    1. Re:Bye Bye public companies... by boxless · · Score: 4, Interesting

      No, it isnt.

      Sarbox, as being practiced these days, are not best practices, except at the largest of companies. A lot of it is crap, and we're going to rolled over by more nimble competitors if we don't watch out.

      You know what, sometimes people are going to steal. And when you find that out, you prosecute. I'm sure there were plenty of laws that the Enron guys could have been charged with regardless of Sarbox.

      I don't think the controls at my company have been improved one bit because Joan in AP can't see the AR screens. Actually, it's worse now, because Joan can take over in a pinch in AR, all in the irrational fear that if she's given access to some information that's not part of her regular function, she's suddenly going to steal.

      And a little change to a webpage now takes 3 months (I'm talking a piece of text!). But, it is Sarbox compliant!

      Whoop-de-effing-do.

  4. I spent 3 months in 2006 dedicated to this BS. by FatSean · · Score: 1, Interesting

    Thanks a bunch Enron! Fucking douchebags ruined it for everyone, and they got a slap on the wrist.

    Instead of implementing some much desired features and efficiencies in our systems, we had to jump through hoops ensuring that everything was 'audit ready'. Logs whenever data enters or leaves a system, documentation of all that, etc...

    We're already dealing with J-SOX...your god help me if Europe and Asia start the same crap.

    --
    Blar.
  5. Personal experience with SOX by Anonymous Coward · · Score: 1, Interesting

    Here is my personal experience with SOX, from a sales point of view.

    I can't take purchase orders that are not 100% perfectly filled out. It doesn't matter if I've been doing business with that company for 20 years and they all know me. The PO is now a LEGAL document (contract) and must be completed in full before my manufacturer's will take the order. You know the criteria I am talking about -- FOB, terms, Delivery date, quoted item, a price, etc. Lots of times, with people you've been doing business with a long time, they just send over the purchase order with enough information to fill the order. But again, "enough information to fill the order" and "perfectly filled out" are not the same thing. A simple example is a customer who is picking up the item. They may not fill out the shipping method because - duh - they are picking up from us down the street. That purchase order would not be accepted. It should say "customer pickup", per SOX (not directly, but SOX requires orders/revenues to be fully documented and companies take it to extremes - like with PO's)

    Now, throw in a mix of bureaucracy and attorneys arguing over terms and conditions (net 30, net 60, etc) and guess what? Nothing gets sold.

    It IS happening out in the field and I can safely say that SOX is having some unintended consequences.