But there is, thankfully, an emerging consensus on how to comply in ways that make business sense.

Sox Simplified
Sarbanes-Oxley, which became law in 2004, remains something of a mystery. “Sox is tough; it’s hard,” says Rich Mogull, a Sox analyst at Gartner. “When we look at what companies are doing, there are shifting standards, and auditors enforce the standards differently.”

What it means to be Sox compliant can be a moving target. Many confused CIOs have turned to standard to-do checklists supplied by Sox auditors or consultants. But that strategy, Spaltro argues, frequently leads to no compliance at all. “When they begin to implement [the checklist], they quickly find out how much more it costs than they thought,” he says. “Soon, they can’t keep up with the demands of completing all the items and they give up.”

Spaltro recommends CIOs and security executives sit down with outside auditors, their corporate legal staff and executives from human resources to figure out what Sox compliance means—not what it means in the abstract but what it means to their company specifically. For example, a bank’s risk of not following a strict interpretation of Sox compliance may be higher than, say, an entertainment company like Sony. A bank must build a higher level of trust with its customers because it manages their money. Risks at other companies may be lower, which means compliance may require lower (and less expensive) levels of controls. “I sincerely believe that if we left it all up to the auditors to tell us what works, we wouldn’t have a business at the end of the day,” Spaltro says.

Most compliance experts agree that CIOs should at least be able to show that they have made a good faith effort to comply with the law. For example, the Sox requirement to control access to sensitive information includes deploying ID management, requiring companies to monitor log files. But how do you know if you have met the standard for monitoring, and what is the standard?

For Sergio Pedro, a managing director in PricewaterhouseCoopers’ advisory services practice, monitoring doesn’t mean spending thousands on technology. Rather, he says the process is very similar to the one your CPA may ask you to follow when tracking the days you spend in an office in one state and the days you are in an office in another state: Just write it down. The person designated to monitor the log files should mark on a printed copy of the files any concerns, initial the file and file it. “Sox deficiencies basically involve not being able to produce evidence that you’ve done your job,” Pedro says. “You just have to prove that you checked the process.”