ubernewb

I'm a former Big Four auditor, on the financial side, but I worked pretty closely with our tech folks and I'm now in the tech industry. SOx really does have very strict internal control requirements on financial data and how and where it can pass between systems and people, whether technological systems or physical ones. I've worked with clients who used strict password rotation to fit the law, as well as with clients who didn't do this. As long as the policies are clearly spelled out, do not allow those who are no longer supposed to have access to have access, and are consistent across the organization, it's all good. For example, one company I worked with changed passwords to one system only when someone rolled off the team working on it. That happened infrequently, but more than once a year. The policy was clear, written, and consistent, so it fit the internal control criteria.

Really, we'd need to find what are called 'material weaknesses' or 'significant deficiencies' to make us really stop and consider writing up a finding that would be published. 'Material weaknesses' are considered worse, and would likely lead to the possibility of a material misstatement in the financial statements of the firm. Deficiencies are a step below that. If the firm corrects them, we're okay for the most part, unless the weakness was terrible.

This. I'm a former Big Four auditor, and I can tell you that the consulting-auditing dichotomy is very clear in the industry. Auditing is on the downswing revenue-wise, and consulting will always rake in the dough. My issue is that the consulting relationships (and the big money they bring in) will necessarily impact the independence of the auditors, which is one of the main reasons there is the whole 'Channel 1' - 'Channel 2' split in the first place, and the major reason SOx passed. The Enron debacle was almost entirely because of the fact that Arthur Andersen didn't want to lose out on the major consulting revenue they made from Enron, but were pressured to fudge audit findings or they would lose that client for everything. SOx was an absolute b*h to implement and deal with on the audit and client side, but it made perfect sense from a regulatory perspective. Still, when the clients are paying for their own audits, that's its own ethical issue.

tldr; It's complicated.

Well, in this case the newspaper is owned by a tech billionaire (Bezos), so maybe not the best case study.