Ron Lepofsky

Corporations responsible for complying with Sarbanes-Oxley, face great hurdles with a basic compliance objective: analysis of their (server and security device) event logs. Some do not for lack of awareness, and others because of the difficulty (and cost) of performing the analysis. Further, issuers erroneously place the cost burden of SOX compliance on the IT security department, when the costs should be borne by the CFO’s SOX compliance budget.

The way to get the executive team to pay attention is to provide a quality ROI on any new initiative. If the boards of directors can’t understand the needs of various departments then the only way to their pocketbook is to present them with a bottom line return on their investment.