Re: Best Oracle front end / Query tool for power users

Daniel,

I am only suggesting that Excel has its place in most organizations, and if need be can be incorporated in a process flow that is SOX compliant. And, simply using Excel in a non-compliant way (as most organizations do, large and small) does not constitute a violation of law. Much in the same way that allowing weak passwords is non-compliant, but not a violation of law. I am not suggesting Excel is a be-all for enterprise reporting.

The initial request was for a query tool, which by the author's description implied adhoc queries. No fiduciary should sign off on an unaudited number generated by an adhoc query tool. By definition, query tools are not SOX compliant. The queries do not go through a full SDLC. If used in that fashion they become a development tool - which Excel can be as well:

All cells in a Workbook can be password protected from alteration. All code in a Workbook can be password protected from viewing and alteration.
If desired, a Workbook can follow a full SDLC including requirements definition, design, development, source control, QA, verification, validation and segregated deployment.

My guess is your auditors consider the method of implementation to be the issue and not Excel as a product. If Excel as a product is the issue, I would definitely want to know the specific reasons why. If valid, they would change my assessment.

• Bill

"DA Morgan" <damorgan_at_psoug.org> wrote in message news:1174684194.800194_at_bubbleator.drizzle.com...
> AlterEgo wrote:
>> Daniel,
>>
>> The use of Excel does not violate the SOX law. Non-compliance by error or
>> lack of a compliant process does not violate the law. The law is violated
>> when Title VIII has been breached, having nothing to do with Excel. The
>> operative word in Title VIII is "...knowingly..."
>
> I've a few auditors I have met who would take issue with your
> assessment.
>
> Can you prove the numbers in that spreadsheet were not altered? Better
> be prepared to do so if you expect a sign-off on the financial data.
>
> Might it make it into the hands of an investor, a lawyer, an accountant,
> a regulatory agency? Is it worth the risk so that you can gain nothing
> not better done by Oracle or another company specializing in reporting?
> Not in my estimation.
> --
> Daniel A. Morgan
> University of Washington
> damorgan_at_x.washington.edu
> (replace x with u to respond)
> Puget Sound Oracle Users Group
> www.psoug.org
Received on Fri Mar 23 2007 - 17:47:49 CDT