And I don't wanna talk about it.

Well, no, it's not that bad. We've been putting most of the controls required in place anyway, over the past year. The only problem has been gettng people to actually comply - and I've been tightening the noose slowly via audit logs, etc. over the last few months anyway. So I really don't have many questions. Most of the IT Sarbanes stuff has been commons sense really. Change controls, separation of development, testing, and live envronments, documented backups and security procedures, etc, etc. Our MIS has been giving me 100% support in this, a lot of the technical controls are trivial to set up on the '400. We have consultants to help make sure our bases are covered; the main guy I've been working with has said that we are one of the easest jobs he's had. He's basically just had to turn our written controls and our normal procedures into Visio documents.

*shrug*

There. I've prolly said about 90% of what I'd say in such a forum... Perhaps a thread or two under General Q&A?