Auditors are very concerned about the impacts of staff having excessive access to critical processes and cite the need for appropriate segregation of duties (SOD) in their Sarbanes-Oxley audits. In response, IT is forced to try and comply with a concept that is not very well understood.

• The current interpretation of SOX
• The meaning of "segregation of duites"
• Risks that SOX is concerned about that require segregation of duties
• How to document segregation of duties in an organization
• How to design and document compensating controls for segregation of duties risks

• They will get an overview of the current interpretation of Sarbanes-Oxley
• They will learn what risks that Sarbanes-Oxley is especially concerned with when it comes to segregation of duties.
• They will learn how to document their organizational structure highlighting any segregation of duties issues.
• They will learn how to design and document compensating controls for segregaion of duties risks.

• Compliance officers
• Internal IT audit
• IT Senior Management / IT management
• IT compliance specialists

Instructor Profile
George Spafford possesses a strong interest in the intersection of human factors, security and complexity in IT and how that impacts organizations. He is an experienced practitioner and has directed all aspects of IT operations in production environments, planning, implementation and improvement of IT processes. His expertise has lead to providing regulatory compliance, IT Governance, and process improvement training to colleagues in the USA, Australia, New Zealand and China. He is a prolific author on a wide range of topics encompassing technology business, security, IT governance and co-author of "The Visible Ops Handbook". His Daily News e-mail list subscribers include high level executives from Fortune 500 and international companies.

George has a MBA from Notre Dame, a BA in Materials and Logistics Management from Michigan State University and an honorary degree from Konan Daigaku in Japan. He is a Certified Information Systems Auditor (CISA) and holds ITIL Foundations and Practitioner Release and Control (IPRC) certifications. George is a current member of the ISACA, the IIA, and the IT Process Institute.