Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Great comment, and does a good job of going deeper on my, as you say...terse summary.

The truth is that most of what people do in the name of SOX is cargo culting other people's ideas of appropriate controls.

In this case, you could give admin access to whoever you want. You just need reasonable documented controls around it.



The cargo culting is unfortunately too true. SOX/SOC reporting exists for a reason and it's actually pretty easy to get real value (which is the intent) out of it, as it formalizes what you should be doing anyway. It's a really good feeling when appropriate processes/controls reveal things that fell through the cracks and they get remediated. Prepping for and performing a successful audit needs to involve the company's subject matter experts from multiple departments. If only the CFO is involved early in the process, it makes life harder for the CTO, CISO, and CIO (or whoever they delegate to) later on.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: