RE: Agile SOX

There are probably a few articles out there.
I agree that you will have to adapt to the Auditors, but beware that it could be the case that their requirements change with each new group of young auditors that arrive each year.
But as long as your P.O. accepts a signoff from the "Proxy P.O. for I.T. Requirements that includes SOX", you should be good.

This dilemna is also faced by Pharmaceutical firms that have FDA and documentation tasks embedded into either Acceptance criteria or Defn of Done requirements. 
I would think that the philosophy that "Agile and Quality are built in at the beginning and at every step in the process" would also apply to SOX requirements.
But convincing auditors that your light-weight process adheres to their requirements, too, could be your biggest challenge.

And I wonder if utilitizing a group Peer Code Review might be one avenue to instill the notion into lower team members of SOX requirements - - where you have 3 reviews per program, 2 for quality and 1  of the three done by someone putting on their SOX hat. That person on the team should rotate every so often.

John Voris, AgilePhilly

> Looking for wisdom and for references to authoritative and/or insightful articles too. 
> Michael


------------------------------------
Posted by: "Voris, John" <[email protected]>
------------------------------------

To Post a message, send it to:   [email protected]
To Unsubscribe, send a blank message to: [email protected]