Blog

When positioning your organization to achieve its SOX ITGC objectives and reporting obligations, you can’t take any chances for fear of negative fallout. And while establishing a team of dedicated internal IT audit professionals can help streamline those processes, there are challenges in maintaining such a team—just as there are advantages to substituting an independent IT audit team instead.

In the fast-paced world of business, trust and credibility are table stakes. You've likely invested in compliance certifications to demonstrate your commitment to industry standards. But are you prepared to meet the rising expectations of a new generation of stakeholders who demand more than just compliance?

Back in 2018, the French government introduced—by way of its Public Health Code (Article L.1111-8)— HDS certification, mandating that all entities hosting personal health data must successfully achieve certification. Now, in 2024, they’ve published a new HDS framework with changes, expositions, and removals of language that organizations affected will need to know in order to comply.

As technology continues to evolve and become more robust, organizations have realized they need expertise and to be proactive in identifying risks and implementing controls. But even as new solutions are introduced, the backbone of many compliance and cybersecurity initiatives—including SOX— remains an organization’s internal technology general controls (ITGCs).

Remember when Tom Brady signed with the Tampa Bay Bucs? They clearly felt he could lead their team to new heights, as they agreed to pay Brady $30 million a season. Such an investment was no doubt made easier given Brady’s playing history—the quarterback had previously led the New England Patriots to 17 division titles and six Super Bowl titles. The Bucs knew he was a proven winner, and elected to trust Brady could do the same with his new team.

Auditors. We’re an odd breed. “A necessary pain in the tuchus,” some may say. Admittedly, we’re not everyone’s cup of tea. In fact, in our 20+ years of experience, we’ve seen the word “auditor” invite various visceral responses. To be sure, organizations aren’t always enthusiastic about inviting us assessors in to do the requisite checks, despite the benefits of doing so (and despite being invited guests).

So you’ve committed to an audit. Your customers were asking, or maybe a new regulation came into effect that your organization is now subject to—whatever the reason was, you’ve got to get audited because your audit team is confirmed.

If you’re a parent, you’ve likely had the debate in the car with your young kids—they want to stop for McDonalds and you tell them, “we’ve got food at home.” From their perspective, they want what they want, but from yours, you understand you’ve already made an investment in perfectly good food at the grocery store, and you’re not about to spend any more money that you don’t have to.