Don’t bother speaking to the CIO or anyone on the IT staff if you want to find out how Sola International is using information technology to meet the new reporting requirements mandated by the Sarbanes-Oxley Act. The guy to talk to?Patrick Kiernan, a senior financial systems analyst at the publicly traded, $550 million corrective and sunglass lens design, manufacture and distribution company?reports to the corporate controller. Kiernan is in charge of replacing the company’s manual spreadsheets with an automated reporting system and planning other projects that will further consolidate financial information. He acknowledges that IT can play a small supporting role ("Without IT’s assistance, I couldn’t have had the WAN or the servers"), but he doesn’t see why the CIO should be directly involved with Sarbanes-Oxley. "I doubt if the CIO would even be interested," Kiernan says.

Part 2 Playing By New Rules Your Risks and Responsibilities

Editor’s Note: This story on the IT ramifications of the Sarbanes-Oxley Act is the second in a CIO series on federal legislation that is having a profound effect on how your company manages data, ensures security and protects privacy. Find the first story in the series, "What to Do When Uncle Sam Wants Your Data," at www.cio.com/newrules.

That perspective bodes trouble for the CIO’s long-term role as the keeper of corporate data, but more immediately for companies’ ability to comply with the new government mandates on how they record, track and disclose financial information. And yet it’s an alarmingly pervasive point of view. In an informal survey by CIO of the top 19 companies on the Fortune 100 list, most executives viewed compliance with Sarbanes-Oxley as a finance issue, not a systems issue. A few acknowledged a potential role for IT but insisted it was premature for the CIO to be involved.

They are dangerously mistaken. While Sarbanes-Oxley is financial legislation, at its heart it is about ensuring that internal controls or rules are in place to govern the creation and documentation of information in financial statements. Since IT systems are used to generate, change, house and transport that data, CIOs have to build the controls that ensure the information stands up to audit scrutiny.

And the CEO and CFO aren’t the only ones who are now personally accountable for the validity of that information. CIOs may also be held liable for invalid data, as the unfolding case against HealthSouth illustrates. (HealthSouth fired CIO Kenneth Livesay last month after he pleaded guilty to federal charges of falsifying financial information and conspiracy to commit wire and securities fraud.)