Hackett: companies stint on technology.

• Author: Marshall, Jeffrey
• Position: Compliance

Despite the clear need for technology to play a major role in helping companies achieve Sarbanes-Oxley Act compliance, too many companies surveyed recently by The Hackett Group apparently haven't gotten the message. Two research reports from Hackett's Business Advisory Services recommend actions IT organizations can take to support such compliance efforts.

The reports, "IT Involvement is Critical to the Success of Sarbanes-Oxley Compliance" and "Sarbanes-Oxley Compliance: It's Not Just for Finance," detail the major steps IT organizations can take to support Sarbanes-Oxley compliance efforts. Key findings and recommendations include:

1. IT Participation Is Critical -- "It's almost impossible for a company's Sarbanes-Oxley compliance efforts to be fully successful unless IT plays a major role," says Dr. David Oppenheim, Hackett senior business advisor. "Sarbanes-Oxley mandates that companies do more than just attest to the accuracy of their financial results. They must also prove that controls are in place, so that if the financials weren't accurate, the CEO and CFO would know." IT, he says, must take responsibility for making this happen.

2. Many Companies Continue to Ignore IT -- Hackett's survey of 22 companies found that nearly half do not have IT represented on their Section 404 Project Steering Committee, which is leading the Sarbanes-Oxley compliance efforts. Other key areas--including human resources, legal, operations and internal auditing--are also being excluded by most companies, the survey found.

3. Take a Business Perspective -- The team must begin its Sarbanes-Oxley efforts by working with the functional areas and business units to understand, from a business perspective, what risks exist and what controls are in place to mitigate them. The business perspective is important because it helps set priorities for subsequent efforts, and because it differs from the traditional IT emphasis on broad solutions to issues such as network security and access control.

4. Take...