Achieving Sustainable SOX Compliance at Vipnet

技术

应用基础设施与中间件 - API 集成与管理

适用行业

电信

适用功能

商业运营

用例

监管合规监控
过程控制与优化

服务

系统集成
软件设计与工程服务

挑战

Vipnet, a leading GSM operator in Croatia, was required to comply with the Sarbanes-Oxley Act (SOX) as part of the Mobilkom Austria group. The compliance required making business processes transparent and proving the efficiency of its internal control system. However, the company faced several challenges. Controls weren't specifically defined and couldn't be mapped as part of a process flow, leading to insufficient process mapping. Additionally, controls weren't tested. The company needed a financially oriented approach to process management to become SOX compliant.

关于客户

Vipnet is a leading Global System for Mobile Communications (GSM) operator in Croatia. Within a year of its establishment, the company became the leading GSM operator in the country. Vipnet is known for its progressive network expansion and continuous investments in development. The company attributes its success to a high level of international knowledge and experience in mobile communications and the enthusiasm of its partners. Vipnet is owned by Mobilkom Austria AG and is one of the most successful companies in Croatia.

解决方案

Vipnet used process management as a starting point and ARIS Audit Manager as the tool to support SOX implementation. The company organized the compliance project with strong support from top management. The greatest focus was needed in the areas of finance and support for Control Objectives for Information and related Technology (COBIT) requirements. Vipnet established an additional process view—the so-called SOX or MCOT view. Risks were detected and mitigated using appropriate controls. Control effectiveness needed to be proven by explicitly defined testing. Vipnet used ARIS Risk & Compliance Manager to support employees with this challenging task by planning, triggering, and tracking tests of Vipnet’s installed controls.

运营影响

Internal control of financial reporting now in place through processes, controls and by testing plans and results in a consistent database.
Dependable and effective internal control system.
Improved documentation quality.

数量效益