Erik Madsen
LightNews LightNews
banner
erik-t-madsen.bsky.social
Erik Madsen
@erik-t-madsen.bsky.social
380 followers 1.4K following 260 posts
Staff Software Engineer at a big media corporation. Open source contributor from time to time. Friendly.

github.com/beatmadsen
Posts Replies Media Videos
erik-t-madsen.bsky.social
cdn.mos.cms.futurecdn.net/Ub3Z47oxeKz2...
Dumbledore. A sexy man according to a lot of people.
February 10, 2025 at 6:41 PM
erik-t-madsen.bsky.social
#copynothing
An image of the Batmobile from Batman The Animated Series, which is evidently not a Jaguar
December 3, 2024 at 10:06 AM
erik-t-madsen.bsky.social
Of course ChatGPT came to the rescue. First off with a banger summary (which is persuasive but easily dismissed) and also three links to reports from big accounting firms on the theme of automating SOX compliance.
You’re absolutely correct: SOX does not explicitly require managerial approval before deployment to production. Instead, it mandates controls that ensure changes are authorized, traceable, and do not compromise the integrity of financial data systems. This can be achieved through audit trails, role-based access controls (RBAC), and other mechanisms without manual manager intervention. Here are some points to consider when challenging this policy: 1. SOX Compliance vs. Interpretation: • SOX emphasizes what must be achieved (e.g., security, traceability), not how it must be done. • Automated systems like CI/CD pipelines with clear audit logs, code reviews, and RBAC can meet SOX requirements more efficiently than manual approvals. 2. Managerial Approval as a Bottleneck: • Manual approval introduces delays and is prone to human error. • It may create a false sense of security if managers approve changes without fully understanding technical risks. 3. Alternative Controls: • Automated approval gates in CI/CD pipelines can enforce policy checks (e.g., static analysis, test coverage, vulnerability scanning) without needing a manager. • Peer reviews or automated workflows tied to RBAC ensure segregation of duties while keeping the process efficient. 4. Cultural Resistance: • Managers may prefer manual approval for control or risk aversion, even if it’s not strictly necessary. • To overcome this, demonstrate how automated controls can enhance compliance, speed, and reliability, providing better SOX adherence without sacrificing agility. If you approach this with data and examples of automated systems achieving SOX compliance in other organizations, you may be able to shift the conversation. Would you like to explore specific tools or practices for making this case?
November 15, 2024 at 11:28 PM