Implementation of Sarbanes-Oxley Act

system · June 23, 2004, 2:59pm

Does it work to simply save the email logs from Exchange?

Is there a required format?

Time retention?

-----Original Message-----
From: pjw@... [mailto:pjw@...]
Sent: Wednesday, June 23, 2004 12:52 PM
To: vantage@yahoogroups.com
Subject: RE: [Vantage] Implementation of Sarbanes-Oxley Act

Todd & Charles
On a side note, exchange 2003 has provisions for a network retention policy.

Has anyone in the list set this up? How well did it work?

Patrick Winter

-----Original Message-----
From: Todd Anderson [mailto:tanderson@...]
Sent: Wednesday, June 23, 2004 11:44 AM
To: 'vantage@yahoogroups.com'
Subject: RE: [Vantage] Implementation of Sarbanes-Oxley Act

Charles,

Sounds like you've had a chance to go through this.

Currently we are deleting all traces of emails as quickly as we can. In the
event of a lawsuit we would be unable to produce old emails except in the
few cases where employees saved emails manually in Outlook folders.

I've always wondered if we had any legal requirements to save all emails
going into or leaving the company.

Have you ever seen a clear statement on email retention requirements?

Thanks,

Todd Anderson

-----Original Message-----
From: HPN Charles Paluska [mailto:cpaluska@...]
Sent: Wednesday, June 23, 2004 11:25 AM
To: vantage@yahoogroups.com
Subject: Re: [Vantage] Implementation of Sarbanes-Oxley Act

What are your concerns ?

Sarbanes-Oxley is directed at the behavior of the Officers and Board members
of public companies, the SEC's dominon (fox guarding the hen house), audits,
and the accounting firms conducting them.

The only items that seemed relevent were:

Section 409: Real Time Disclosure.
Issuers must disclose information on material changes in the financial
condition or operations of the issuer on a rapid and current basis.

and

Title VIII: Corporate and Criminal Fraud Accountability Act of 2002.

It is a felony to "knowingly" destroy or create documents to "impede,
obstruct or influence" any existing or contemplated federal investigation.

Auditors are required to maintain "all audit or review work papers" for five
years.

The statute of limitations on securities fraud claims is extended to the
earlier of five years from the fraud, or two years after the fraud was
discovered, from three years and one year, respectively.

Employees of issuers and accounting firms are extended "whistleblower
protection" that would prohibit the employer from taking certain actions
against employees who lawfully disclose private employer information to,
among others, parties in a judicial proceeding involving a fraud claim.
Whistle blowers are also granted a remedy of special damages and attorney's
fees.

A new crime for securities fraud that has penalties of fines and up to 10
years imprisonment.

These two sections seem to say - accurate and frequent reporting (via
Vantage) should be done and no data within the system should be allowed to
be altered, destroyed, or fabricated without proper documentation.

Charles

system · June 23, 2004, 11:46am

I'm interested in communicating with anyone who has successfully
implemented the Sarbanes-Oxley Act of 2002. And how it interacts with
Vantage would be of interest as well.
Thanks,
Bob Walton

system · June 23, 2004, 12:24pm

What are your concerns ?

Sarbanes-Oxley is directed at the behavior of the Officers and Board members of public companies, the SEC's dominon (fox guarding the hen house), audits, and the accounting firms conducting them.

The only items that seemed relevent were:

Section 409: Real Time Disclosure.
Issuers must disclose information on material changes in the financial condition or operations of the issuer on a rapid and current basis.

and

Title VIII: Corporate and Criminal Fraud Accountability Act of 2002.

It is a felony to "knowingly" destroy or create documents to "impede, obstruct or influence" any existing or contemplated federal investigation.

Auditors are required to maintain "all audit or review work papers" for five years.

The statute of limitations on securities fraud claims is extended to the earlier of five years from the fraud, or two years after the fraud was discovered, from three years and one year, respectively.

Employees of issuers and accounting firms are extended "whistleblower protection" that would prohibit the employer from taking certain actions against employees who lawfully disclose private employer information to, among others, parties in a judicial proceeding involving a fraud claim. Whistle blowers are also granted a remedy of special damages and attorney's fees.

A new crime for securities fraud that has penalties of fines and up to 10 years imprisonment.

These two sections seem to say - accurate and frequent reporting (via Vantage) should be done and no data within the system should be allowed to be altered, destroyed, or fabricated without proper documentation.

Charles

system · June 23, 2004, 12:42pm

Charles,

Sounds like you've had a chance to go through this.

Currently we are deleting all traces of emails as quickly as we can. In the
event of a lawsuit we would be unable to produce old emails except in the
few cases where employees saved emails manually in Outlook folders.

I've always wondered if we had any legal requirements to save all emails
going into or leaving the company.

Have you ever seen a clear statement on email retention requirements?

Thanks,

Todd Anderson

-----Original Message-----
From: HPN Charles Paluska [mailto:cpaluska@...]
Sent: Wednesday, June 23, 2004 11:25 AM
To: vantage@yahoogroups.com
Subject: Re: [Vantage] Implementation of Sarbanes-Oxley Act

What are your concerns ?

Sarbanes-Oxley is directed at the behavior of the Officers and Board members
of public companies, the SEC's dominon (fox guarding the hen house), audits,
and the accounting firms conducting them.

The only items that seemed relevent were:

Section 409: Real Time Disclosure.
Issuers must disclose information on material changes in the financial
condition or operations of the issuer on a rapid and current basis.

and

Title VIII: Corporate and Criminal Fraud Accountability Act of 2002.

It is a felony to "knowingly" destroy or create documents to "impede,
obstruct or influence" any existing or contemplated federal investigation.

Auditors are required to maintain "all audit or review work papers" for five
years.

The statute of limitations on securities fraud claims is extended to the
earlier of five years from the fraud, or two years after the fraud was
discovered, from three years and one year, respectively.

Employees of issuers and accounting firms are extended "whistleblower
protection" that would prohibit the employer from taking certain actions
against employees who lawfully disclose private employer information to,
among others, parties in a judicial proceeding involving a fraud claim.
Whistle blowers are also granted a remedy of special damages and attorney's
fees.

A new crime for securities fraud that has penalties of fines and up to 10
years imprisonment.

These two sections seem to say - accurate and frequent reporting (via
Vantage) should be done and no data within the system should be allowed to
be altered, destroyed, or fabricated without proper documentation.

Charles

system · June 23, 2004, 12:56pm

Charles,

I should have specified in my first post that my concerns center around IT issues. As Dir. of IT, I've been asked by the Acct'g folks to install whatever software is needed to make us compliant. Microsoft has a 183 page Deployment Guide for their Office Solution Accelerator for Sarbanes-Oxley. When I got into the Accelerator, I came upon the need for MS's
SharePoint Services. Then there is the issue of running all this on 1 server, 2 servers (the preferred, at least by MS), or a server farm. So instead of wading through 183 pages, I was hoping that someone had consolidated all of MS technibabble into a few pages of clear and concise instructions.
Bob Walton

HPN Charles Paluska wrote:

[Non-text portions of this message have been removed]

system · June 23, 2004, 12:57pm

Our company is spending a considerable effort and expense preparing for SOX. There is a lot more requirements for IT then previously needed.
I know for instance that we are required to track all non-successful login attempts to our network and investigate each one.
There are a dozen or so other requirements like this.

Jeremy Leonard
IT Manager
K-T Corporation

-----Original Message-----
From: Todd Anderson [mailto:tanderson@...]
Sent: Wednesday, June 23, 2004 12:44 PM
To: 'vantage@yahoogroups.com'
Subject: RE: [Vantage] Implementation of Sarbanes-Oxley Act

Charles,

Sounds like you've had a chance to go through this.

Currently we are deleting all traces of emails as quickly as we can. In the
event of a lawsuit we would be unable to produce old emails except in the
few cases where employees saved emails manually in Outlook folders.

I've always wondered if we had any legal requirements to save all emails
going into or leaving the company.

Have you ever seen a clear statement on email retention requirements?

Thanks,

Todd Anderson

-----Original Message-----
From: HPN Charles Paluska [mailto:cpaluska@...]
Sent: Wednesday, June 23, 2004 11:25 AM
To: vantage@yahoogroups.com
Subject: Re: [Vantage] Implementation of Sarbanes-Oxley Act

What are your concerns ?

Sarbanes-Oxley is directed at the behavior of the Officers and Board members
of public companies, the SEC's dominon (fox guarding the hen house), audits,
and the accounting firms conducting them.

The only items that seemed relevent were:

Section 409: Real Time Disclosure.
Issuers must disclose information on material changes in the financial
condition or operations of the issuer on a rapid and current basis.

and

Title VIII: Corporate and Criminal Fraud Accountability Act of 2002.

It is a felony to "knowingly" destroy or create documents to "impede,
obstruct or influence" any existing or contemplated federal investigation.

Auditors are required to maintain "all audit or review work papers" for five
years.

The statute of limitations on securities fraud claims is extended to the
earlier of five years from the fraud, or two years after the fraud was
discovered, from three years and one year, respectively.

Employees of issuers and accounting firms are extended "whistleblower
protection" that would prohibit the employer from taking certain actions
against employees who lawfully disclose private employer information to,
among others, parties in a judicial proceeding involving a fraud claim.
Whistle blowers are also granted a remedy of special damages and attorney's
fees.

A new crime for securities fraud that has penalties of fines and up to 10
years imprisonment.

These two sections seem to say - accurate and frequent reporting (via
Vantage) should be done and no data within the system should be allowed to
be altered, destroyed, or fabricated without proper documentation.

Charles

system · June 23, 2004, 1:38pm

We too are just beginning to look into an email retention
policy. I've been advised to retain all emails and I've been
advised to delete all emails. So now what??

Retaining sure would be a help for us right now because
we're stuck between a vendor/customer issue and if we could
reproduce who said what, when and to whom we'd be off the
hook. On the other hand, I've been told that we do not want
to retain any emails because they can be used against us in
court.

Why would an email be treated any differently than a piece
of paper? If it's worth saving on paper isn't it worth
saving electronically?

Marty Kuphall
Chief Financial Officer
Ultra Tool & Manufacturing, Inc.
W169 N5954 Ridgewood Drive
Menomonee Falls, WI 53051

Phone: 262-703-0455
Fax: 262-703-0468
Toll Free: 800-779-3566
marty.kuphall@...
www.ultratoolmfg.com

The information contained in this electronic message (email)
and any
attachment(s) to it is/are intended for the exclusive use of
the intended addressee(s) and may contain information that
is confidential and/or privileged and exempt from disclosure
under applicable law. If you are not the intended
recipient(s) and have received this communication in error,
please do not distribute it. Instead, please notify Ultra
Tool & Manufacturing, Inc. at 1-800-779-3566 or by email at
general@... and destroy all copies of this
message and any attachments. Thank you.

-----Original Message-----
From: Todd Anderson [mailto:tanderson@...]
Sent: Wednesday, June 23, 2004 11:44 AM
To: 'vantage@yahoogroups.com'
Subject: RE: [Vantage] Implementation of Sarbanes-Oxley Act

Charles,

Sounds like you've had a chance to go through this.

Currently we are deleting all traces of emails as quickly as
we can. In the
event of a lawsuit we would be unable to produce old emails
except in the
few cases where employees saved emails manually in Outlook
folders.

I've always wondered if we had any legal requirements to
save all emails
going into or leaving the company.

Have you ever seen a clear statement on email retention
requirements?

Thanks,

Todd Anderson

-----Original Message-----
From: HPN Charles Paluska
[mailto:cpaluska@...]
Sent: Wednesday, June 23, 2004 11:25 AM
To: vantage@yahoogroups.com
Subject: Re: [Vantage] Implementation of Sarbanes-Oxley Act

What are your concerns ?

Sarbanes-Oxley is directed at the behavior of the Officers
and Board members
of public companies, the SEC's dominon (fox guarding the hen
house), audits,
and the accounting firms conducting them.

The only items that seemed relevent were:

Section 409: Real Time Disclosure.
Issuers must disclose information on material changes in the
financial
condition or operations of the issuer on a rapid and current
basis.

and

Title VIII: Corporate and Criminal Fraud Accountability Act
of 2002.

It is a felony to "knowingly" destroy or create documents to
"impede,
obstruct or influence" any existing or contemplated federal
investigation.

Auditors are required to maintain "all audit or review work
papers" for five
years.

The statute of limitations on securities fraud claims is
extended to the
earlier of five years from the fraud, or two years after the
fraud was
discovered, from three years and one year, respectively.

Employees of issuers and accounting firms are extended
"whistleblower
protection" that would prohibit the employer from taking
certain actions
against employees who lawfully disclose private employer
information to,
among others, parties in a judicial proceeding involving a
fraud claim.
Whistle blowers are also granted a remedy of special damages
and attorney's
fees.

A new crime for securities fraud that has penalties of fines
and up to 10
years imprisonment.

These two sections seem to say - accurate and frequent
reporting (via
Vantage) should be done and no data within the system should
be allowed to
be altered, destroyed, or fabricated without proper
documentation.

Charles

system · June 23, 2004, 1:52pm

Todd & Charles
On a side note, exchange 2003 has provisions for a network retention policy.

Has anyone in the list set this up? How well did it work?

Patrick Winter

-----Original Message-----
From: Todd Anderson [mailto:tanderson@...]
Sent: Wednesday, June 23, 2004 11:44 AM
To: 'vantage@yahoogroups.com'
Subject: RE: [Vantage] Implementation of Sarbanes-Oxley Act

Charles,

Sounds like you've had a chance to go through this.

Currently we are deleting all traces of emails as quickly as we can. In the
event of a lawsuit we would be unable to produce old emails except in the
few cases where employees saved emails manually in Outlook folders.

I've always wondered if we had any legal requirements to save all emails
going into or leaving the company.

Have you ever seen a clear statement on email retention requirements?

Thanks,

Todd Anderson

-----Original Message-----
From: HPN Charles Paluska [mailto:cpaluska@...]
Sent: Wednesday, June 23, 2004 11:25 AM
To: vantage@yahoogroups.com
Subject: Re: [Vantage] Implementation of Sarbanes-Oxley Act

What are your concerns ?

Sarbanes-Oxley is directed at the behavior of the Officers and Board members
of public companies, the SEC's dominon (fox guarding the hen house), audits,
and the accounting firms conducting them.

The only items that seemed relevent were:

Section 409: Real Time Disclosure.
Issuers must disclose information on material changes in the financial
condition or operations of the issuer on a rapid and current basis.

and

Title VIII: Corporate and Criminal Fraud Accountability Act of 2002.

It is a felony to "knowingly" destroy or create documents to "impede,
obstruct or influence" any existing or contemplated federal investigation.

Auditors are required to maintain "all audit or review work papers" for five
years.

The statute of limitations on securities fraud claims is extended to the
earlier of five years from the fraud, or two years after the fraud was
discovered, from three years and one year, respectively.

Employees of issuers and accounting firms are extended "whistleblower
protection" that would prohibit the employer from taking certain actions
against employees who lawfully disclose private employer information to,
among others, parties in a judicial proceeding involving a fraud claim.
Whistle blowers are also granted a remedy of special damages and attorney's
fees.

A new crime for securities fraud that has penalties of fines and up to 10
years imprisonment.

These two sections seem to say - accurate and frequent reporting (via
Vantage) should be done and no data within the system should be allowed to
be altered, destroyed, or fabricated without proper documentation.

Charles

system · June 23, 2004, 1:59pm

Charles

These two sections seem to say - accurate and frequent reporting (via
Vantage) should be done and no data within the system should be allowed to
be altered, destroyed, or fabricated without proper documentation.

Vantage seems to be a good fit, once you put something in know how difficult
it is to alter or remove.

Is it true SOX only affects publicly traded companies?

Patrick Winter

-----Original Message-----
From: HPN Charles Paluska [mailto:cpaluska@...]
Sent: Wednesday, June 23, 2004 11:25 AM
To: vantage@yahoogroups.com
Subject: Re: [Vantage] Implementation of Sarbanes-Oxley Act

What are your concerns ?

Sarbanes-Oxley is directed at the behavior of the Officers and Board members
of public companies, the SEC's dominon (fox guarding the hen house), audits,
and the accounting firms conducting them.

The only items that seemed relevent were:

Section 409: Real Time Disclosure.
Issuers must disclose information on material changes in the financial
condition or operations of the issuer on a rapid and current basis.

and

Title VIII: Corporate and Criminal Fraud Accountability Act of 2002.

It is a felony to "knowingly" destroy or create documents to "impede,
obstruct or influence" any existing or contemplated federal investigation.

Auditors are required to maintain "all audit or review work papers" for five
years.

The statute of limitations on securities fraud claims is extended to the
earlier of five years from the fraud, or two years after the fraud was
discovered, from three years and one year, respectively.

Employees of issuers and accounting firms are extended "whistleblower
protection" that would prohibit the employer from taking certain actions
against employees who lawfully disclose private employer information to,
among others, parties in a judicial proceeding involving a fraud claim.
Whistle blowers are also granted a remedy of special damages and attorney's
fees.

A new crime for securities fraud that has penalties of fines and up to 10
years imprisonment.

These two sections seem to say - accurate and frequent reporting (via
Vantage) should be done and no data within the system should be allowed to
be altered, destroyed, or fabricated without proper documentation.

Charles

system · June 23, 2004, 2:19pm

Patrick,

My understanding is that SOX not only affects publicly traded companies but
also can affect privately held companies as well, at least to the extent
that those privately held companies provide audited financial statements to
creditors who rely on the statements to make their credit decisions.

Regards,
Scott

-----Original Message-----
From: pjw@... [mailto:pjw@...]
Sent: Wednesday, June 23, 2004 1:58 PM
To: vantage@yahoogroups.com
Subject: RE: [Vantage] Implementation of Sarbanes-Oxley Act

Charles

These two sections seem to say - accurate and frequent reporting (via
Vantage) should be done and no data within the system should be allowed to
be altered, destroyed, or fabricated without proper documentation.

Vantage seems to be a good fit, once you put something in know how difficult
it is to alter or remove.

Is it true SOX only affects publicly traded companies?

Patrick Winter

-----Original Message-----
From: HPN Charles Paluska [mailto:cpaluska@...]
Sent: Wednesday, June 23, 2004 11:25 AM
To: vantage@yahoogroups.com
Subject: Re: [Vantage] Implementation of Sarbanes-Oxley Act

What are your concerns ?

Sarbanes-Oxley is directed at the behavior of the Officers and Board members
of public companies, the SEC's dominon (fox guarding the hen house), audits,
and the accounting firms conducting them.

The only items that seemed relevent were:

Section 409: Real Time Disclosure.
Issuers must disclose information on material changes in the financial
condition or operations of the issuer on a rapid and current basis.

and

Title VIII: Corporate and Criminal Fraud Accountability Act of 2002.

It is a felony to "knowingly" destroy or create documents to "impede,
obstruct or influence" any existing or contemplated federal investigation.

Auditors are required to maintain "all audit or review work papers" for five
years.

The statute of limitations on securities fraud claims is extended to the
earlier of five years from the fraud, or two years after the fraud was
discovered, from three years and one year, respectively.

Employees of issuers and accounting firms are extended "whistleblower
protection" that would prohibit the employer from taking certain actions
against employees who lawfully disclose private employer information to,
among others, parties in a judicial proceeding involving a fraud claim.
Whistle blowers are also granted a remedy of special damages and attorney's
fees.

A new crime for securities fraud that has penalties of fines and up to 10
years imprisonment.

These two sections seem to say - accurate and frequent reporting (via
Vantage) should be done and no data within the system should be allowed to
be altered, destroyed, or fabricated without proper documentation.

Charles