Corporate governance deals with how effectively and efficiently the "Tone at the Top" as defined by the CEO, top management and Board of directors is working. As far as governance is concerned IT governance also plays a very important role in the overall organizational governance. IT Governance consists of IT organization governance and Application & data governance. IT governance strangly affects the way risks are managed in an organization. A strong governance atmosphere ensures that the control environment which is a COSO component sets the right tone at the top. Similarly, with strong IT governance management can have some assurance that company level controls are working as intended.

So how does IT governance relates to Section 402 and Section 302 of the Sarbanes Oxley Act. Section 402 requires management to evaluate and assess the risks within the various business processes. Similarly, Section 302 deals with management certification. IT governance has a direct impact on the way process owners evalute processes, manage risks within processes, come up with control solutions and ensure controls are working effectively.

IT organization governance addresses the management of technology area within the organization. The other part of overall IT governance addressess issues relating to application owners. If both of these are properly defined and implemented in an organization, compliance with Sarbanes Oxley Sections 404 and 302 IT controls becomes much more streamlined if not easier.

Related Posts

Cost Effective Approach to Sarbanes Oxley
Sarbanes Oxley Record Retention
Implementing ERM Enterprise Risk Management Framework
4 Simple Steps in Designing Internal Controls