Achieving Sustainable SOX Compliance at Vipnet

Technology Category

Application Infrastructure & Middleware - API Integration & Management

Applicable Industries

Telecommunications

Applicable Functions

Business Operation

Use Cases

Regulatory Compliance Monitoring
Process Control & Optimization

Services

System Integration
Software Design & Engineering Services

The Challenge

Vipnet, a leading GSM operator in Croatia, was required to comply with the Sarbanes-Oxley Act (SOX) as part of the Mobilkom Austria group. The compliance required making business processes transparent and proving the efficiency of its internal control system. However, the company faced several challenges. Controls weren't specifically defined and couldn't be mapped as part of a process flow, leading to insufficient process mapping. Additionally, controls weren't tested. The company needed a financially oriented approach to process management to become SOX compliant.

About The Customer

Vipnet is a leading Global System for Mobile Communications (GSM) operator in Croatia. Within a year of its establishment, the company became the leading GSM operator in the country. Vipnet is known for its progressive network expansion and continuous investments in development. The company attributes its success to a high level of international knowledge and experience in mobile communications and the enthusiasm of its partners. Vipnet is owned by Mobilkom Austria AG and is one of the most successful companies in Croatia.

The Solution

Vipnet used process management as a starting point and ARIS Audit Manager as the tool to support SOX implementation. The company organized the compliance project with strong support from top management. The greatest focus was needed in the areas of finance and support for Control Objectives for Information and related Technology (COBIT) requirements. Vipnet established an additional process view—the so-called SOX or MCOT view. Risks were detected and mitigated using appropriate controls. Control effectiveness needed to be proven by explicitly defined testing. Vipnet used ARIS Risk & Compliance Manager to support employees with this challenging task by planning, triggering, and tracking tests of Vipnet’s installed controls.

Operational Impact

Internal control of financial reporting now in place through processes, controls and by testing plans and results in a consistent database.
Dependable and effective internal control system.
Improved documentation quality.

Quantitative Benefit