TravisDBA (11/28/2012)

---

It's not just unencrypted data that auditors ding you on nowadays. Wearing many hats at once and doing things outside your job description can definitely get you dinged as well. SarBox standards are very picky on this nowadays..For example, we had an IT guy once caught moving furniture around in his cube and the auditors jumped all over that with managment and the man was reprimanded over it. Not in his job description, don't do it again. If you are a little shop you can still get away with a "Jack-of-all-trades" guy (I don't know for how long though), but that is no longer permitted at most larger shops or government agencies that fall under the strict auditing standards of today. Heck, the auditors dinged us for having our production clusters on the second node, left there after a failover!!!!! Picky, picky...

John Hanrahan (11/28/2012)[hr]I have been through several SOX audits and have never heard of that. I would have have said stick it, see the job description says "and other duties as required" which I think is in every single job description I have seen for years. The whole point of SOX is to document what you do and how you do it anWwwd make sure everyone knows (including shareholders and regulators). It has always seemed overblown to me. Next they'll say you can't get up to get water to quench your thirst because you have to operate the water fountain.

David.Poole (11/28/2012)

---

Regulation is a cloud that can have a bright silver lining.

Lets suppose that you have old systems ridden with tech debt and propped up by manual processes.
Those powers that be are so used to the situation that the idea that the tech debt or the manual processes are a problem just doesn't register. They are chasing the new shiny ball.

All of a sudden regulation comes along and lifts up the rock and shines a bright light underneath it and reveals the superating horrors squirming underneath!

Too many people have too much access to too much data almost certainly meaning a failed regulatory audit.
All of a sudden you have the impetus and support to fix a load of old problems and simplify the way your systems work. Do this well and not only will you pass regulatory inspection but you will also demonstrate the art of the possible, how good things could be if the prime focus was delivering something maintainable, scalable, flexible.

Michael Valentine Jones (11/28/2012)

---

My impression is that most "auditors" have no idea what they are doing, and just make things up like "no moving furniture if it isn't in your job description".