[News]

News:

[Anonymous]

Anonymous

Anonymous

• Guest

So, we've met with our auditors on year 2 SOX compliance, and the rule have changed a bit with the recent PCAOB guidance.  The auditors are much more concerned about change management now than last year.  They are going beyond separation of duties and looking at how we can prove that no one made out of cycle changes - ie. some sort of positive check on application changes.

My question is this: how should I approach this?  Is there specific log evidence that can be collected and used?  Should we be looking at other technologies like tripwire?

[mutex]

mutex

mutex

Show mutex's last posts.

Show general stats for mutex.

• 
• Administrator
• Newbie
• Posts: 782

I'd recommend using something like tripwire to reconcile file changes with change requests, to show that no changes were made outside of the change management process.