The Sarbanes-Oxley Act of 2002 overhauled the processes and accountability for financial reporting in US-listed companies and made corporate executives explicitly responsible for annually establishing, evaluating and monitoring the effectiveness of internal controls over financial and operational processes.  While the majority of the financial reporting processes take place in back-office systems, much of the work continues to be ad-hoc in nature and occurs in standard desktop applications such as spreadsheets and email.

Sarbanes-Oxley Section 404

Section 404 of Sarbanes-Oxley specifically calls for US-listed companies to establish and maintain the necessary internal control mechanisms to ensure the financial reporting process complies with the law. In order to comply with section 404 of Sarbanes-Oxley, companies must implement internal controls that:

• Expire access to spreadsheets with errors
• Protect data from access and modification by unauthorized users
• Track actions on data as it crosses application and organizational boundaries

Complying With Sarbanes-Oxley

Liquid Machines Document Control and Email Control help US-listed companies implement internal controls that protect data and audit information usage as mandated by Sarbanes-Oxley by:

• Automatically identifying email that contain financial information
• Enforcing access and usage policies that control content through its lifecycle whether at rest or in transit
• Permitting users to change only select data and locking down other areas of the spreadsheet
• Dynamically provisioning and de-provisioning access and usage globally and enforcing it locally.
• Ensuring all participants in the financial reporting process are aware of spreadsheet updates and saving copies for future audits
• Enabling companies to define when content control and protection can be removed and by whom.  
• Providing detailed logs and audit trails of content access and usage in a format that can be easily stored, viewed and imported into other enterprise systems
• Supporting compliance activities without changing the way users work