Sarbanes-Oxley Act of 2002 and IT Education

Introduction Congress passed the Sarbanes-Oxley Act (SOX) in 2002 as a response to the public outcry over the financial scandals of many large corporations (Haskin, 2004). Top level management, chief executive officers (CEO's) and chief financial officers (CFO's), took advantage of poor internal control and reporting systems to misstate the actual financial position and results of their corporations for personal gain. Congress charged the Securities and Exchange Commission (SEC) with the responsibility of implementation and oversight. Since the passage of SOX in 2002 the SEC has been busy issuing rules and interpretations on the requirements of the act. Most of the literature on the SOX act center around what finance and accounting professionals are doing to comply with the act. Underlying the concerns of accounting and finance is the data and information requirements that are specified or alluded to in the act. This paper will discuss what information technology (IT) professionals and educators need to be aware of in SOX. IT Education Related to Sarbanes-Oxley O'Brien (2004, p. 261) defines information quality as those characteristics that make information products valuable and useful. O'Brien (2004) presents these characteristics in dimensions of time, form, and content. The time dimension includes timeliness and currency, which provide up-to-date information needed for real-time decision making. Real-time reporting of material events is a requirement of SOX (Katz, 2003, 2004b). The form dimension requires that information be presented at the appropriate level of detail that is easy to understand and interpret. The content dimension covers the areas of accuracy, relevance, completeness, conciseness, scope, and use for performance measurement. The areas of accuracy and completeness fall under the internal control certifications required by SOX. The important point to make here is that these characteristics of information quality are not new. These characteristics have been recognized by the IT profession for over 20 years, not just since 2002 after the passage of SOX. Knowledge of internal controls and designing of controls into information systems is also not a new concept. Henry and Borrus (2005) state, "after all, Section 404 restates what was already required in other federal laws and regulations. Since the late '70s, the Foreign Corrupt Practices Act has required companies to have internal controls, and auditors have long been expected to test them before signing off on financial statements." The only difference is that now execs and auditors must certify that the controls work and that no material weaknesses exist (Henry & Borrus, 2004). So if we have known about information quality and the necessity of controls why did we see the financial abuses of the late 1990's and early 2000's? It would appear that top-level management chose to override and/or ignore them. Carpenter, Fennema, Fretwell, and Hillison (2004) indicate that systems of controls are no better than the people that create, use, and supervise them. Durak (2004) makes this point by stating that "management can easily manage and boost earnings by changing the assumptions underlying key accounting estimates." Carpenter et al. (2004) also feel that external auditors need to be more skeptical and unpredictable in their audit of a company and quit trying to sell consulting services to their clients. The thing that is different with SOX, that was not in the previous acts, is the "jail time" penalty for non-compliance (Carpenter et al., 2004; & Henry & Borrus, 2004). Risk management is another technique proposed as a way to mitigate problems with SOX compliance. Satzinger, Jackson, and Burd (2004) discuss risk management and mitigation as part of a software development project. Basically it requires management and development staff to identify risks, estimate the outcomes and the possibility of their occurrence, assign a priority to each identified risk, and to develop and implement strategies to mitigate the risks. …