财务和IT人员的SOX法案指南

Sarbanes-OxleyGuideforFinanceandInformationTechnologyProfessionalsSANJAYANANDJohnWiley&Sons,Inc.ch00_FM_4621.qxd1/24/0612:09PMPageiiiSarbanes-OxleyGuideforFinanceandInformationTechnologyProfessionalsch00_FM_4621.qxd1/24/0612:09PMPageich00_FM_4621.qxd1/24/0612:09PMPageiiSarbanes-OxleyGuideforFinanceandInformationTechnologyProfessionalsSANJAYANANDJohnWiley&Sons,Inc.ch00_FM_4621.qxd1/24/0612:09PMPageiiiThisbookisprintedonacid-freepaper.Copyright©2006bySarbanesOxleyGroup.Allrightsreserved.PublishedbyJohnWiley&Sons,Inc.,Hoboken,NewJersey.PublishedsimultaneouslyinCanada.Nopartofthispublicationmaybereproduced,storedinaretrievalsystem,ortransmittedinanyformorbyanymeans,electronic,mechanical,photocopying,recording,scanning,orotherwise,exceptaspermittedunderSection107or108ofthe1976UnitedStatesCopyrightAct,withouteitherthepriorwrittenpermissionofthePublisher,orauthorizationthroughpaymentoftheappropriateper-copyfeetotheCopyrightClearanceCenter,Inc.,222RosewoodDrive,Danvers,MA01923,978-750-8400,fax[phone],oronthewebat://:Whilethepublisherandauthorhaveusedtheirbesteffortsinpreparingthisbook,theymakenorepresentationsorwarrantieswithrespecttotheaccuracyorcompletenessofthecontentsofthisbookandspecificallydisclaimanyimpliedwar-rantiesofmerchantabilityorfitnessforaparticularpurpose.Nowarrantymaybecreatedorextendedbysalesrepresentativesorwrittensalesmaterials.Theadviceandstrategiescontainedhereinmaynotbesuitableforyoursituation.Youshouldconsultwithaprofessionalwhereappropriate.Neitherthepublishernorauthorshallbeliableforanylossofprofitoranyothercommercialdamages,includingbutnotlimitedtospecial,incidental,consequential,orotherdamages.Forgeneralinformationonourotherproductsandservices,ortechnicalsupport,pleasecontactourCustomerCareDepartmentwithintheUnitedStatesat800-762-2974,outsidetheUnitedStatesat317-572-3993orfax317-572-4002.Wileyalsopublishesitsbooksinavarietyofelectronicformats.Somecontentthatappearsinprintmaynotbeavailableinelectronicbooks.FormoreinformationaboutWileyproducts,visitourWebsiteat(Sarbanes-OxleyCompliantKeyEnterpriseTechnology)istrademarkedbytheSar-banes-OxleyGroup.LibraryofCongressLibraryofCongressCataloginginPublicationDivisionCIP20540-4320101IndependenceAvenue,S.E.9140EastHamptonDriveWashington,DC20540-4320CapitolHeights,MD20743LibraryofCongressCataloging-in-PublicationDataAnand,Sanjay.Sarbanes-Oxleyguideforfinanceandinformationtechnologyprofessionals/SanjayAnand.p.cm.Includesindex.ISBN-13:978-0-471-78553-8(cloth)ISBN-10:0-471-78553-9(cloth)1.UnitedStates.Sarbanes-OxleyActof2002.2.Corporations—Accounting—Lawandleg-islation—UnitedStates.3.Disclosureofinformation—Lawandlegislation—UnitedStates.4.Financialstatements—Lawandlegislation—UnitedStates.I.Title.KF1446.A9452006346.7306648—dc222005031928PrintedintheUnitedStatesofAmerica10987654321ch00_FM_4621.qxd1/24/0612:09PMPageivThisguideisdedicatedtomyfamilyandtotheinnocentswhohaveenduredtheharshconsequenceofcorporatefraud.ch00_FM_4621.qxd1/24/0612:09PMPagevch00_FM_4621.qxd1/24/0612:09PMPageviviiContentsPREFACExiACKNOWLEDGEMENTSxiiiINTRODUCTION1PARTISarbanes-OxleyForTheFinanceProfessional24CHAPTER1ScopeandAssessmentoftheAct25Integrity25Independence25ProperOversight26Accountability26StrongInternalControls26Transparency26Deterrence27CorporateProcessManagement27CHAPTER2InternalControls32ComponentsofInternalControl33PurposeofInternalControl36DevelopinganInternalControlSystem37CHAPTER3ControlEnvironment49RiskAssessment49InformationandCommunication54Monitoring56CHAPTER4MaterialWeaknesses58SpecificInternalControlstoEvaluate58DisclosureCommittee59ch00_FM_4621.qxd1/24/0612:09PMPageviiCHAPTER5ImplementingSarbanes-Oxley:WhatDoesComplianceLookLike?62TimeLine62Checklists64Reporting,Documentation,andArchiving72Disclosure72CHAPTER6TechnologyImplications74StorageSystems75ITSolutions77ChangesinITManagement78CHAPTER7Sarbanes-Oxley–RelatedBodies79PublicCompanyAccountingOversightBoard79CommitteeofSponsoringOrganizations80SecuritiesandExchangeCommission82FinancialAccountingStandardsBoard83CHAPTER8OpportunitiesandChallengesCreatedbySarbanes-Oxley84Opportunities84Challenges86CHAPTER9SummaryfortheCFO90ChangestoCorporateGovernance90CatalystforImprovement91PARTIISarbanes-OxleyForTheITProfessional93CHAPTER10ImpactofSarbanes-Oxley95ImpactontheEnterprise,theCEO,andtheCFO95ImpactofSarbanes-OxleyonCorporateManagementSystems97ImpactofSarbanes-OxleyontheTechnologyInfrastructure100CHAPTER11TechnologiesAffectedbySarbanes-Oxley:FromSarbanes-OxleytoSOCKET106SeparateVendorHypefromReality106Sarbanes-OxleyComplianceasanITProject107PerspectiveonSarbanes-OxleyGoals108StepsforSarbanes-OxleyCompliance109viiiContentsch00_FM_4621.qxd1/24/0612:09PMPageviiiSarbanes-OxleyandTheSEC113CHAPTER12EnterpriseTechnologyEcosystem114Organ