Changing software at the end of year process 2051



  • Hi,
    I would like to know if it exists a time before or after end of year process to have the right to change software (like ERP) according to SOx :?:
    For the moment, I didn’t find it directly in the law (but I’m not American and it’s relatively technical so maybe I missed it :oops: ).
    Maybe it only concerns IT governance framework like CobIT :roll: What is your opinion or your knowledge about it ?
    Thanks for your help 🙂
    Mickael



  • You have the right to change software whenever you choose as the appropriate time for your organisation in order to meet business needs, this is not - and should not - be governed by any legislation.
    Generally though it is risky to change significant financial systems such as an ERP within 3 months of the year-end. For SOX purposes you would have to be able to demonstrate that control processes are operating effectively post systems changed and it is natural to have teething problems.



  • Yes, As Denis shares SOX doesn’t restrict you in changing software at any time as desired. However, if the software being changes is associated with a financial system, some of the following would be helpful from a SOX perspective:
    – Use or establish change control and communication process for the transitition process.
    – Establish a detailed Test Plan. Measurements and success criteria would be established in advance for successful transition (e.g., # of parallel runs, file comparisons between PROD and new system, acceptable # of differences, who will sign off, etc)
    – Also, establish how you will balance the new system and it’s master files in detail, so that system owners will feel comfortable in transitioning to the new environment. This includes both financial measures and qualitative controls (e.g., assuring fields are copied over correctly or converted accurately to new coding schemes)
    – Establish lengthy backups of the old system in case you need to reference it (SOX also requires 7 years of history anyway)
    – Establish and communicate what is required from a SOX perspective to all team members (e.g., in case they need to save test runs, documentation, balancing, etc)



  • Thank you very much Denis and Harry for your reply 😄
    I think I have all the needed information now to communicate about it 😛
    Best Regards
    Mickael


Log in to reply