New App Automates Key Step Mandated By Sarbanes-OxleyNew App Automates Key Step Mandated By Sarbanes-Oxley

Security-software maker Virsa Systems Inc. is pushing an app it says will help companies remain in compliance with stringent Sarbanes-Oxley Act provisions.

Access Enforcer version 1.2 does two things: It creates an automated and customizable workflow procedure for giving employees access rights to SAP. As part of the automated provisioning of an employee, a risk assessment is automatically done to make sure a worker doesn't get access rights that would violate Sarbanes-Oxley.

For example, one person isn't allowed to both create a vendor account and pay bills associated with that account. Some in the past have set up a dummy account, paid company money into the account, and collected the money themselves.

Andy Smith, product-marketing manager for Virsa, says too many companies are going through their access rights to make sure they don't have conflicts, but they're doing it manually and some will probably forget about doing it again.

Virsa's software, however, becomes an ongoing Sarbanes-Oxley traffic cop. Managers who want to give an employee new or different access rights have to go through the provisioning process, including a risk assessment.

Access Enforcer (the version number is misleading; previous versions were alpha tests, and this is the app's debut), only works with SAP apps, but Smith says Oracle and PeopleSoft Inc. versions are planned. Virsa has built into the app perhaps 80% of the common auditor rules applicable to public companies, he says. Any others a customer has are created by Virsa before installation.

Part of Virsa's Continuous Compliance Suite, Access Enforcer is priced at $50,000 per SAP license.