Graphic illustration of Governance Model applied to traditional COSO Cube,

1. Sarbanes-Oxley’s Impact on
the COSO Cube
Section Section
404 302
Section
409
IT Components
Server Logs, Database Logs, Firewall
Logs, Intrusion Detection, Incident
Response, Awareness Training
Monitoring
IT Policies, Standards & Procedures
Email, Scorecards, Dashboards, Project
Control, Help Desk
Information & Communication
Firewalls, Security, DRP, Business
Continuity, SDLC, Change Control,
Operations
Control Activities
IT Risk Management,
IT Risk Assessments,
Business Impact Analysis
Risk Assessment
“Tone at the top”, IT Governance,
Regulatory Compliance Control Environment
1