• What we do:
•	Review existing documentation and automated processes. When appropriate, we conduct staff interviews with minimal disruption to business activities.
•	Assess, edit or create design documents. The results are comprehensive functional and technical specifications.
•	Collate or develop detailed plans for all testing phases from unit through end-to-end. These plans are stored along with resulting files and reports, proving compliance with business requirements.
• With whom we work:
	Each component migrated into a Sarbanes-Oxley system production environment must first be approved by an officer. Together with related documentation, testing plans/ and results, and reconciliations, a complete package for each production migration is ready for review for Sarbanes-Oxley compliance.
• How it's accomplished:
LBi has developed automated balancing reconciliations for:
•	401k Contributions Interface Files vs. the General Ledger and Payroll Reports
•	FSA Contributions Interface Files vs. the General Ledger and Payroll Reports
•	Health and Dental Deductions vs. the General Ledger and Payroll Reports
•	Transit and Parking Deductions
•	Accounts Payable/Receivable Transactions

These reconciliations accurately account for data transmitted between systems and applications. They also display errors and warnings that trigger analysis and investigation by the responsible individuals.

How can LBi help you?

With minimal interruption of daily business processes, LBi professionals will collect and formalize all the evidence of compliance your auditors will need. This means your employees are free to conduct business as usual.

Our automated reconciliations mean that a push of a button will replace hours of tedium and inefficiency.

LBi’s narratives are a permanent and updatable description of responsibilities, competencies, and processes surrounding SOX systems.

Sarbanes-Oxley regulations require risk assessment, risk reduction and continual auditing. In particular, there is the requirement to track users’ authority and file access on all corporate servers.

LBi designed and developed a cohesive application and methodology to support SOX auditing requirements called SOX Server Reporting:
1.	Administration Application – an application that imports defined log files from all servers and loads them into a MySQL database.
2.	Database – a MySQL database designed for speed and usability, complete with backup and import processes
3.	Reporting – a browser-based reporting tool that allows the end user to access reports to ensure compliance. This enables server security groups to run on-demand reports to determine SOX compliance.

(SOX Server Reporting)

How can LBi help you?

LBi will modify the data gathering process from your servers and log files to match the database layout. The Data Gathering process limits the data to only what is required and transfers all files from your line servers to a separate standalone processing server.

LBi will install the database and Administration Application. The Administration Application imports data and performs administrative server functions and will import the transferred UNIX and NT files into a reporting database. Additional screening can be performed at this point to further limit imported data.


(Administration Application)
The reporting tool can then be used by end users to create audit reports. The Report front-end is a web application (browser-based) that allows users to select criteria for creating summary reports for selected servers or all servers. Because these summary reports are based on exceptions, they are more effective.


(Reporting Application)

The application supports the following reports:
•	UNIX File Vulnerability – Accepted Vulnerabilities
•	UNIX File Vulnerability - Set-uid/set-gid Details
•	UNIX File Vulnerability - World Writable Directories
•	UNIX File Vulnerability - World Writable Files
•	UNIX File Vulnerability - Orphan Details
•	UNIX File Vulnerability - Orphan Summary
•	UNIX User Access Accountability - Recertification Management Report
•	UNIX User Access Accountability - Update Access Listing Detail
•	UNIX User Access Accountability - Group Members
•	NT File Vulnerability