CHL has been heavily involved in a number of Sarbanes-Oxley projects. For more detail click on the links below.
Project for a European distributor - SOX in French!
Project for electronic top-ups for mobile telephone users
Project for chemical / polymer company
Irish Telecom company
What did the clients say?
Quality of SOX documents and procedures
European computer networks and hardware distribution
A well-established US financial consultancy was appointed by a US hardware distributor to provide advice and guidance in preparation for a Sarbanes Oxley audit by external auditors. This project was required to serve not just the activity in the US but worldwide including European countries such as the UK, France, Italy and Switzerland.
For the activity in France there was an additional requirement for French-speaking support and Stephen Helms of CHL was appointed, primarily to assist with the heavy documentation load of such a project. However, the role was extended to include translation of accounting questionnaires, initial interviews, narratives, testing and the provision of corporate advice from the US consultancy. The project extended over a 4-month period and provided significant assistance to the client and satisfaction to CHL. A brief description of the activity by month follows:
- Nov 2004
Documentation and translation of ICQs (Internal Company Procedures) and Narratives for accounts issues of Sarbanes-Oxley project in Paris for a US hardware distributor. Interviews in French.
- Dec 2004
On site work in Paris for Accountancy ICQs and Narratives for Sarbanes-Oxley project, template development, technical support for new French colleagues. Familiarization with IT issues for Sarbanes-Oxley project.
IT Narrative development for Sarbanes-Oxley (SOx) project for US IT vendor in France. Interviews and source material in French; translated and transformed into US English SOx document for review and testing.
- Jan 2005
Commissioned to undertake COSO Lite version of Sarbanes-Oxley 404 for the IT activities of subsidiaries of US hardware and cabling installation company.
Visits and information gathering in French near Paris and the south of France for COSO Lite; report writing. SOx testing at main French site. Organization charts, Business flow charts, network diagrams and application flows in Visio.
- Feb 2005
First round of Testing on Sarbanes-Oxley project in France followed by more assistance and research. Working with English, French and American colleagues.
Updating Narratives for SOx based on the recommended remediation with further discussions and translation work for the three sites in France.
- Mar 2005
Final updating of Narratives for SOx in France and completion of CHL work on the project.
Electronic top-up services
A midwest American company provides secure electronic financial transaction solutions worldwide and includes the collection and distribution of electronic top-up services to mobile telephone operators and retailers. Obliged to conform to Sarbanes-Oxley (SOX) legislation, the main European company appointed CHL in late June 2005 as an advisor and to provide and update the relevant documentation. Starting with the production of house style, Key Controls, reviews of policies and continuity plans, interviewing and the collection of information, CHL produced first drafts of descriptive documents or Narratives.
The project continued with creating, reviewing narrative documents in line with COBIT style key controls; currently focussing on the systems development life cycle, user access (including authorization, authentication and passwords) and backup and recovery. CHL also provided additional support:
- Use of Visio for complex diagrams.
- Word .dot templates for interactive forms for User Access, New product / reseller setup and models for Business Needs Statements, Functional and Technical Design documents
- Provision of Word support / training
- Review, planning discussions and documentation of IT procedures and project management.
- Conversion of existing company reference documents including the Staff Handbook, Job Contract, Information Security Policy, Usage of IT infrastructure agreement, Business Continuity Plan
The project was extended twice to enable:
- Further preparation for the new models required by the Internal Audit function of the US parent company.
- Updating narratives in line with remediation agreed with the Internal Auditor
- Updating procedures with new Intranet-based tools and experience of their usage
- Initial planning for security training and improved testing
American Chemical Company
With 17 locations in 9 countries and its corporate headquarters are in Houston, Texas this American chemical company is a major international player. Given its size, turnover and shareholder base it is required to comply to Sarbanes-Oxley as are its subsidiaries overseas. Discussions and a formal proposal to provide pre-audit IT Testing won the business so CHL was able to assign two recently added associates - American IT auditors (Jorge Martinez and Howard Whitener) - to the project with Stephen Helms as project manager. The initial UK site visit in July was followed by the start up in the French office in August 2005.
SOX 404 IT Controls testing by the two CHL IT Auditors was carried out in France and included the testing of IT Management, Change Control, Operations and Security. The project continued with the testing in the UK and the Netherlands and finally Italy. Testing was completed by very early September and work completed with a Project Summary Report immediately afterwards.
In summary, CHL through its associates was able to provide competent IT auditors at short notice during the summer period and the project started only a week later than originally requested. The work schedule worked well with both auditors being on site together for the first and last weeks of the project. Project time and associated project management time were well within acceptable time and cost limits for a project of this nature. The client has expressed satisfaction with the quality of the auditors and their work and thus on the bases of timeliness, quality and cost, the project was judged a successful one.
Irish Telecom company
An Irish Telecom company in Dublin wished to provide a firm foundation of information concerning the compliance issues of Cobit, ITIL, Sarbanes-Oxley and ISO. Following visits and a two-week initial development period, CHL was commissioned in July 2006 to present three variations of the course to eight different audience groups, covering 180 IT staff. 36 presentations were made with very satisfactory results:
A 68-page manual was provided to each delegate and provided much more than the all too common copies of overhead slides: the manual comprised full-text descriptions, tables of contents and figures, together with cross-references and index to ensure the accessibility of the information.
The information presented was maintained throughout the 3-4 month period of the project - this was very important following changes in ownership and organization.
What did the clients have to say?
European hardware distribution company:
"C’était un plaisir, également pour nous, de travailler avec vous. Je vous remercie beaucoup pour votre professionnalisme. Bonne continuation et à bientôt peut-être.
Financial Director, Sarbanes-Oxley Client, France
Merci beaucoup pour touts vos souhaites, c'est très gentil et sympa. A mon tour j'aimerais vous souhaiter plein de bonnes choses et encore une fois, merci de votre aide et professionnalisme.
Technical Sales Manager, Sarbanes-Oxley Client, France
"Vous avez refait notre organigramme. Je l'ai trouvé très bien fait."
Quality Manager, Sarbanes-Oxley Client, France
"Thank you for the attention you have been giving to finishing up the IT Narrative documentation for [the three sites in France]. Your follow up efforts have been much appreciated."
IT Project Manager, Sarbanes-Oxley Consultancy organization, UK & France.
“I would like to say Thank You for all of the hard work you put into [the client project]. The quality of your documents was very good. In addition, your ability to speak and write in the dual languages was a great benefit to the project. I do really appreciate all your efforts and am confident that we will cross paths again in the near future.”
Project Manager, Sarbanes-Oxley Consultancy organization, Europe.
Electronic top-up services
"Thank you for all your flexibility, hard work and advice. I would hope we can work together again soon."
Managing Director, UK company.
American chemical company:
“Dear Jorge, Thanks for your work and the open discussion we had during our wrap-up meeting this afternoon. I am very pleased to see and hear that the hard work the IT people did during the past months was successful. This illustrates in my view that the IT department understands what SOX is about and that they had the right spirit to get this done.
Well done! Best regards and I wish you a safe onward journey and maybe we will meet again at some stage in the future.”
Senior Manager, Netherlands
Irish Telecom company
See Comments Ireland for delegate comments from the series of presentations.