What has your role and experience been upon which your opinion is based?
What I have seen of SOX compliance when it came in for multiple companies that I was involved. Every time what I saw matches the description pretty closely. The auditor comes in, sees what you are doing, reads the rules, negotiates with you a set of procedures that you can do and in their opinion will bring you in compliance with the rules, then you execute that.
The rules themselves are so vague that what they will be interpreted to mean varies widely by auditor. But the legal requirements for the company are met if the auditor signs off on it, so you do whatever your auditor says to do. Those involved knows that a lot of the created procedures are silly, but the legal problems if you don't go through the charade are quite real, so you have to do them anyways.
That is not to say that real problems aren't regularly uncovered. I'm sure that they are. But there is a tremendous amount of arbitrariness in, "Here is what you need to do to be compliant."
And your experience is that the procedure arrived at isn't highly arbitrary?
If so, can you explain why your experience is so sharply different from everyone else's?
(Note, internet claims of "I have significant experience" are the same as claims of "I am an expert" - only credible when they come with other evidence from which we can judge expertise.)
What has your role and experience been upon which your opinion is based?
What I have seen of SOX compliance when it came in for multiple companies that I was involved. Every time what I saw matches the description pretty closely. The auditor comes in, sees what you are doing, reads the rules, negotiates with you a set of procedures that you can do and in their opinion will bring you in compliance with the rules, then you execute that.
The rules themselves are so vague that what they will be interpreted to mean varies widely by auditor. But the legal requirements for the company are met if the auditor signs off on it, so you do whatever your auditor says to do. Those involved knows that a lot of the created procedures are silly, but the legal problems if you don't go through the charade are quite real, so you have to do them anyways.
That is not to say that real problems aren't regularly uncovered. I'm sure that they are. But there is a tremendous amount of arbitrariness in, "Here is what you need to do to be compliant."