Since my trip to London earlier this year, I have actively pondered what the future brings for the standard of due care. Specifically, what frameworks and practices will emerge as being the minimum standard to which we are judged in our efforts to protect data. In my post on US vs. UK perspectives for choosing a controls framework I mentioned how the people I talked to in the UK were focused on becoming ISO compliant with regards to their security programs and that they felt this was a competitive differentiator for their businesses. They also stressed the outside validation provided by BSI on a recurring basis as an independent audit and how it helped establish confidence in their ability to protect sensitive customer information.

With the absolutlely phenomenal reach of PCI DSS, and the move by Nevada to legislate its adoption, I think we are entering into an era where this standard becomes the minimum. After all, with it being so widely enforced it soon becomes what a reasonable person in similar circumstances must do.
The real trick for practitioners then becomes not the controls being applied, but the effectiveness and efficiency that the organization can expect on a per dollar basis. In summary, it isn’t what you are controlling, or even how, it is how well that matters.

Related articles:

1. 2008: More ID Theft

“…all publicly traded U.S. companies would be required to use IFRS within six years. However, at least 110 companies could use the international rules as early as next year, depending on their size and their industry. The SEC predicts that those companies would each incur about $32 million in additional costs in the 10-Ks they file in 2010.”

For everyone else, the SEC estimates that U.S. companies will spend between 0.125 percent and 0.13 percent of their revenue on making the transition to international financial reporting standards from U.S. GAAP in the first year of filing.  This is just more evidence that the new revenue stream the accounting firms have been waiting for is here. Some of my former Big 4 colleagues (including a partner) have come out and told me as much.  The big difference though between SOX and IFRS is that once companies have made the transition, that’s it.  In other words, unlike SOX, IFRS has an end date.

It should also be noted that this timeline could change once Barack Obama takes office in January.  SEC chairman Christopher Cox is a Republican, and he has indicated he will resign early next year. Comments to the roadmap are due in mid-February, so we’ll have to wait and see what the final version will look like.

Related articles:

1. Grant Thornton Survey says CFOs don’t like IFRS
2. AICPA Comes out in Favor of IFRS
3. Is IFRS All About Greed?

If the SEC takes the committee's advice, all U.S. publicly traded companies could be required to file audited XBRL financial statements in three years.  Reading further, it looks like I'm not the only one who sees higher audit fees in the future.

"At Monday's meeting, Peter Wallison, a senior fellow at the American Enterprise Institute for Public Policy Research, tried to assuage committee members' fears that the use of XBRL could lead to high assurance costs for companies hiring auditors to check that they have tagged data correctly."

It's fairly obvious that this is a done deal, and anyone who voices concerns over higher assurance costs will simply be ignored.  Vendors are already lining up to provide XBRL implementation services, and audit firms are right behind them.  I know this sounds cliche, but I can hear CFOs everywhere mumbling that "the hits just keep on coming."

Related articles:

1. Are Higher Audit Fees in Your Future?
2. IFRS: The New Cash Cow
3. Grant Thornton Survey says CFOs don’t like IFRS

Back in June of this year, Sestus Data released a white paper that detailed how non-compliant banks were with FFIEC multi-factor authentication guidelines.  In this paper the researchers concluded that only 4% of sampled banks employed consistently multi-factor authentication methods, while 64% used single-factor only.  So, are we to believe that most of these banks have gotten their act together in the last five months?  I seriously doubt that.  Unfortunately, there is no link to the original research mentioned in this news item, but I strongly suspect that the researchers adopted the banks' definition of "multi-factor authentication" as opposed to the FFIEC's.  Anyone who is familiar with this issue understands that the banks have been waging a fierce battle with the FFIEC over what exactly constitutes multi-factor authentication, with the banks adopting a much more lax definition.  I'll keep a lookout for this latest research paper to see if I'm right.

Related articles:

1. Multi-Factor Headaches
2. Mobile Phones as Keyfobs?
3. AICPA Comes out in Favor of IFRS

At the hearing, the AICPA Vice Chairman for Professional Standards and Services, Chuck Landes told the sub-committee “One common accounting language will benefit all participants in the capital markets. A single worldwide set of accounting standards would help investors by facilitating the comparison of financial results.”

However, former SEC Chief Accountant Lynn Turner warned that adopting IFRS could put US investors at risk. “I believe strongly if the SEC reconciliation is eliminated, it will also eliminate the incentive for standard-setters to work together,” he said. “Indeed, each of the standard-setters is likely to go their own way, and I suspect within 10 years, if not sooner, FASB will cease to exist, leaving the U.S. without a viable private standard-setter responsive to the needs of U.S. investors.”

Related articles:

1. IFRS: The New Cash Cow
2. Is IFRS All About Greed?
3. Grant Thornton Survey says CFOs don’t like IFRS

Related articles:

1. TD Ameritrade Breach
2. Restitution for Victms of ID Theft
3. Randomize Those Administrator Passwords

He specifically criticized the certification requirements as being usesless.  I agree with his comments on certifications.  The folks at Enron would have signed the certifications because they thought what they were doing was correct.  They fired or demoted anyone who didn't agree with them.  Anderson agreed that what they were doing was right.  Therefore, I am not sure that the cerfications would have made a difference.

Not to be left out, Mitt Romney has also suggested that we prune SOX.   In remarks to the Detroit Economic Club, he stated that "it's driving away IPO's, depressing jobs, and requiring billions of unnecessary cost."  

On the other side of the aisle, John Edwards is proposed last Friday that we expand corporate responsibility further than Sarbanes and require companies to publish more information on executive compensation and social impact.

As the election gets closer, I am sure that this issue will continue to be a hot topic. 

Related articles:

1. Are Higher Audit Fees in Your Future?
2. Talking Up Sarbanes-Oxley?

Related articles:

1. IFRS: The New Cash Cow
2. AICPA Comes out in Favor of IFRS
3. SEC Told to Mandate XBRL

Related articles:

1. 2008: More ID Theft
2. IT Pros Routinely Break the Rules
3. New FTC Requirement!

It seems that there are reports and studies being released all the time now purporting to show that SOX has had a positive effect on reducing fraud and improving investor confidence in capital markets. Yet the only "evidence" we see is either anecdotal, or it's based on opinions from respondents to a poll or survey.  And of course we're going to see glowing reports from audit firms, the federal government, the SEC, and the PCAOB.  Can you imagine one or more of the above groups stating that SOX has been a colossal waste of time and money and should never have been passed in the first place? Of course not! They have to talk it up no matter what the reality is. What's worse is that this official party line permeates industry to such a degree that it becomes almost politically incorrect to challenge it. I wonder what would happen if I openly criticized SOX as a total disaster in my next presentation at an ISACA or IIA meeting.  Would I ever be invited back?   Perhaps, but I'd rather not find out. Besides, I would receive a much warmer response at an event consisting mostly of IT people. They've hated SOX from day one, so there would be no love lost there. I'd simply be preaching to the choir. However, there are some rumblings out there that suggest that SOX may not be theanswer to global warming – cure for cancer – peace on earth solution that many think it is.

A story released yesterday says that according to the most recent biannual global survey of economic crime conducted by PricewaterhouseCoopers, 53 percent of US companies reported they had been hit by economic crime during the last two years, with losses totaling $223 million.  Companies of all sizes were affected, and the level of fraud has not dropped (italics mine) in the eight years that the firm has been conducting the survey. However, seventy-one percent of the US respondents said they thought that Sarbanes-Oxley was at least some help in detecting economic crime inside the company, and 61 percent thought it was at least some help for detecting economic crime that originated outside the company. So, we see here that fraud has remained steady for the last eight years, but the majority of the respondents still have to credit SOX in some way for that. Why? I mean SOX has only been around for four years, so how do we know that there would have been a huge increase in fraud had SOX never been passed? We don't! It's simply a nonfalsifiable presupposition, and since we'll never really know for sure, it becomes extremely easy to credit SOX. 

Another article states that for the first time in four years, a survey of in-house corporate lawyers shows that the rate of corporate litigation has fallen. Fifty-five percent of the respondents credited Sarbanes-Oxley with the decline in litigation, but experts also pointed to the recent relative stability of the economy and the rising stock market, which tends to produce fewer disputes involving corporations. Here again we see obligatory credit being given to SOX, but it's nice to see that at least some experts can still think for themselves by pointing to other factors.

I'm not saying that SOX has not had any kind of positive effects; I am saying that there are too many people creditng SOX without really thinking about why they're doing so. If you really believe SOX has helped then be prepared to provide harder evidence than a survey conducted by an audit firm or the SEC. Let's really debate the topic for once.

Related articles:

1. SOX as a campaign issue
2. 20% of IT Budgets Spent on Security
3. Welcome Mark Adams!