Sarbanes-Oxley versus Agile
Agile development assumes that the participents are professionals. We take it for granted that everyone will do the best for the team, that everyone is skilled and capable, and that the team is focused on the project being successful for the sponser. It’s the assumption of doing the right thing that allows us to skimp on the paperwork and excessive formality. Trust is presumed.
Then came Enron.
OK, so there is no trust to be had when it comes to large sums of money, but we developers don’t make financial decisions. What’s Enron got to do with us?
Well, quite a lot as it turns out. You see, the defence of main culprits was ignorance. They “innocently” lost control of the finances and didn’t know what was going on. Negligent leadership yes, criminal act no, they pleaded. It’s to remove that defence that the US govenment introduced the Sarbanes-Oxley legislation. A financial officer accidently losing control of the finances is no longer a satisfactory excuse for staying out of jail. Not only that, but auditors have the duty and right to report any loss of financial control to the shareholders, and for a public company to the public, to give early warning. That’s not a small detail. An international bank, say, that recieved a bad audit on this score would not welcome the publicity. After Enron, it gives the market the jitters.
So what? This is a programming blog, so stick to the point Marcus. OK, I will. The point is that the loss of trust extends all the way down to our daily working practices. Some examples, the obvious one first.
Development time costs money. That money should be tied back to a specific project or task. Free floating development costs are a black hole, and black holes are no longer acceptable. You can emply some kind of standard accounting tool to keep track of this, or you can invent your own. Trouble is, if you invent your own you are subject to an audit every year. Accountants probably won’t be very impressed with a homebrew system that works on index cards, and so using some kind of standard will save a lot of trouble. The change management tool vendors love this of course. Tying version control check-ins to requirements tools is the kind of stuff that cash cows are made of. Tool vendors are spreading the word.
Now if you are very lucky, you have an enlightened project manager who understands the value of refactoring. You see a problem unrelated to your current work, you fix it right then. Everyone wins…er…except you. You have to shoehorn this piece of opportunism through the change management tool. From the demonstrations I have seen so far, these tools don’t look too agile.
Suppose you are writing some simple database code that generates a report. Not much need to refactor here, this has been done hundreds of times. Well, the data in this report probably gets used in the performance indicators of the company, the profit and loss figures upon which the big decisions are made. If there is suspicion of that data, the company is losing control of it’s finances. It could be decieving the shareholders too. This is not about testing, it’s about having the authority to work on that report. The software as well as the data must be secure and no one person may hold all the keys. Your handling of passwords becomes subject to external policy. Opening the version control system to shared code ownership may not be part of that policy. That’s a big loss for an agile team.
None of these problems are insurmountable of course. A dash of politics, some technical adjustments and a dose of guerilla refactoring may get you through the day, but it’s still friction. Fear spreads.
