I was the SOX lead for the Consumer group regarding EDI and interfaces when we were faced with our first SOX audit Back In The Day.
It'll be a little while before I can get anything together from my archives -- but the most important thing that you need to get your auditors to buy into is the fact that EDI IS A COMPENSATING CONTROL and not a primary control. Primary controls, like audit trails, control totals in the source and target systems, etc. are the object of most audits and scrutiny, but you should get them to agree that any EDI processing is a compensating control (that's the magic word.) Until we decided to take that tack, we were faced with the prospect of revalidating all of our maps and trading partnerships for both internal and external audit groups. Once we realized that we had no real control over the data that came in -- the primary control and business logic existed in the receiving systems -- we were able to simply point to these facts: 1) There are access controls on the production system preventing *unaudited* production dataset access. 2) There are access controls on the production mapping preventing *unaudited* production map changes. 3) There are SOPs in place to detect mapping failures as they are received from the VAN and the primary responsible group is trained to respond to these. With this in place, EDI becomes an important - but still manageable -- component. I have seen people have all access - including browse - removed from maps, datasets, etc. all in the name of SOX. That is ridiculous. SOX 404 is about accountability for changes and auditability of the process, not about people kept from doing their work. Let me know if you need specific questions answered -- or examples -- and I'll be happy to help you out. Nobody should face SOX alone. LOL Rich Hurd EDI Lead-SAP Process Teams Johnson & Johnson Consumer Companies North American Consumer IT 908-874-1523 -----Original Message----- From: [email protected] [mailto:[EMAIL PROTECTED] Behalf Of [EMAIL PROTECTED] Sent: Thursday, July 12, 2007 10:29 AM To: [email protected] Subject: [EDI-L] gentran NT narrative for SOX compliance Has anyone had to write up a narrative for Gentran for SOX? Our company just went public in February. We are doing the documentation of our various IT systems to become compliant. I'm struggling, as I'm sure many of you have, with trying to explain EDI. Any help would be appreciated! Cindy [Non-text portions of this message have been removed] ... Please use the following Message Identifiers as your subject prefix: <SALES>, <JOBS>, <LIST>, <TECH>, <MISC>, <EVENT>, <OFF-TOPIC> Job postings are welcome, but for job postings or requests for work: <JOBS> IS REQUIRED in the subject line as a prefix. Yahoo! Groups Links ... Please use the following Message Identifiers as your subject prefix: <SALES>, <JOBS>, <LIST>, <TECH>, <MISC>, <EVENT>, <OFF-TOPIC> Job postings are welcome, but for job postings or requests for work: <JOBS> IS REQUIRED in the subject line as a prefix. Yahoo! Groups Links <*> To visit your group on the web, go to: http://groups.yahoo.com/group/EDI-L/ <*> Your email settings: Individual Email | Traditional <*> To change settings online go to: http://groups.yahoo.com/group/EDI-L/join (Yahoo! ID required) <*> To change settings via email: mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] <*> To unsubscribe from this group, send an email to: [EMAIL PROTECTED] <*> Your use of Yahoo! Groups is subject to: http://docs.yahoo.com/info/terms/
