[billwagnon]

I've done some work in the SOX field on the IT side in the past few years. SOX aka the "full employment for auditors" act.

The basic requirement for a publicly traded company is that they must know "for sure" that financial statements are accurate. I don't see this as a bad thing.

If you have a system that ultimately feeds numbers to financial statements, you must ensure that the system data is appropriately protected.

There was a lot of fear the first couple years and people went crazy, then things settled down a lot once the big 4 agreed on, imho, totally arbitrary levels of compliance.