There Is No Such Thing as a "SarBox Compliant" Product

Well over a year ago, I publicly lamented the fact that we were sure to see products labeled as "Sarbanes-Oxley Compliant" or "Sarbanes-Oxley Section 404 Compliant", much as vendors stamped products "Y2K compliant" only 5-6 years ago. This is nothing but FUD (Fear, Uncertainty and Doubt), and it is starting to tick CIOs off. And it does not help when a vendor is making calls to Big 4 accounting firms asking them to give their seal of approval that the product is SarBox compliant. Listen up you Einstein vendors, The Sarbanes-Oxley Act of 2002 is about processes, not products!

Here is the story, and I will be emailing a link to this story to the product vendor in question.

There are four (4) major accounting firms, and I will call them A, B, C, and D. The vendor in question called Big 4 Firm A last week trying to get a product "certified", saying that Big 4 Firm B is providing these services. I heard about this through the grapevine and asked senior people at firms A and B, and they both said that "we do not do that". Now I hear that this same vendor called Big 4 Firm A yesterday, and said it was Big 4 Firm C that was providing these services.

Here is the problem with this scenario. As much scrutiny as the accounting industry is under, they would never put their names on a product because it very simply exposes them to potential liability if a company implementing these products fails an audit down the road. And they are smart enough, unlike the vendor in question, to know that a product can never be "compliant". It is the process controls used by the company, and the adherence to these controls that determine compliance. All vendors can do is offer products to help implement and monitor controls. There were vendors at Lotusphere 2005 that were not too happy when I took them to task about labeling their products like this to draw people to their pedestals.

So I hope the company in questions backs off, because if they don't, I will name them on here and be on their case (and the case of any other vendor that tries this approach like "white on rice". And if the accounting forms do get in this business, they can expect the same treatment.