397
Appendix:
Understanding the Sarbanes-Oxley Act
A description of the computer systems in place, including servers, type of
network installed, and network operating systems used
A diagram of the network showing key equipment and the overall connection
scheme, and in particular, all routes into or out of the network such as primary
and backup Internet connections or private wide area network (WAN) links
How the network authenticates users, how permissions are managed, and how
users are created and terminated from the system
An overview of the disaster recovery capabilities of the IT department and any
business continuity plans
A description of the systems that are within the scope of the audit, such as the
accounting system, any payroll system, stock administration system, and so
forth
Any custom software or modifications to in-scope systems
The logical access path from a user to the in-scope systems
A description of the change management process, including how changes are
authorized, documented, and tested
Disaster Recovery Plan
While not technically part of the system of internal controls, a disaster recovery plan
(also called a business continuity plan) is a document that a public company's external
auditors will want to evaluate. They will be primarily concerned with details of how
the company's critical business information is protected and how it could be accessed
in the event of a disaster. Accordingly, a disaster recovery plan should describe the
company's backup systems in detail, including the following:
What sort of backup system is in use, in detail
If tapes are used, how they are rotated internally on a daily basis
What type of off-site secure storage is used, how tapes are rotated off-site, and
how rotations are documented
If a colocation scheme is in place, how it operates and how data is replicated
to the other location(s)
How the backup system is periodically tested to ensure that it is working as
designed, that it can restore data, and how the testing is documented
If backups are performed differently for in-scope systems, how they operate for
the in-scope systems (for example, general network backups are typically not
kept for extended periods of time, but backups of an enterprise resource planning
system might periodically make permanent tapes that are kept indefinitely)