RE: Griping about auditing (not the Oracle Kind)

From: Miller, Jay <JayMiller_at_tdwaterhouse.com>
Date: Mon, 25 Jun 2001 08:21:27 -0700
Message-ID: <F001.00336950.20010625080649@fatcity.com>

Frankly, I can understand the concern about data (we're a brokerage and have lots of customer account information). But having a non-technical person approve adding a datafile? And then another non-technical person review that the adding was done according to an approved form? Is it obvious that a non-technical person was setting the audit requirements and not listening when I said it was pointless?

A DBA on another database had his request to increase the next extent size on a table refused on the grounds that "what if this change causes the database to go down?". His explanation that having a table that was over 5,000 extents and growing rapidly was far more likely to cause problems was rejected on the grounds of "if it ain't broke don't fix it. If you say it is broke then why is it we aren't having any problems?"

I wasn't looking for confirmation that this is silly (I know it is) so much as just wondering if anyone else has had to deal with this level of bureaucracy. And maybe a little commiseration :)

Thanks for helping me get it off my chest, Jay Miller

-----Original Message-----
Sent: Monday, June 25, 2001 11:07 AM
To: Multiple recipients of list ORACLE-L

One of the reasons DBA's are paid well is that they have total control over the production data. No matter what rules the auditors put in place, a DBA could manipulate the data if they wanted to. The company should trust you to do your job and not put up read blocks that prevent you from maintaining the database and making changes in a timely manner.

-----Original Message-----
Sent: Monday, June 25, 2001 9:32 AM
To: Multiple recipients of list ORACLE-L

We've been through an internal audit and I was just wondering if anyone else has to deal with the rather ludicrous requirements I now have. In order to add or resize a datafile I now need to fill out a form and get Senior VP approval and the alert logs must be reviewed every day by a non-DBA in order to be certain that I didn't make any database changes without such approval. The auditors were horrified to discover that not only did I do such things whenever I thought them necessary but that we didn't have a non-DBA review everything I did after an Oracle upgrade to ensure I didn't install any other software.
Fortunately I managed to convince them that yes, I really did need a Unix login (they were skeptical).

So, any similar horror stories?

Jay Miller
Sr. Oracle DBA
--

Please see the official ORACLE-L FAQ: http://www.orafaq.com
--

Author: Miller, Jay
INET: JayMiller_at_TDWaterhouse.com

Fat City Network Services    -- (858) 538-5051  FAX: (858) 538-5051
San Diego, California        -- Public Internet access / Mailing Lists
--------------------------------------------------------------------

To REMOVE yourself from this mailing list, send an E-Mail message to: ListGuru_at_fatcity.com (note EXACT spelling of 'ListGuru') and in the message BODY, include a line containing: UNSUB ORACLE-L (or the name of mailing list you want to be removed from). You may also send the HELP command for other information (like subscribing).
--

Please see the official ORACLE-L FAQ: http://www.orafaq.com
--

Author: Smith, Ron L.
INET: rlsmith_at_kmg.com

Fat City Network Services    -- (858) 538-5051  FAX: (858) 538-5051
San Diego, California        -- Public Internet access / Mailing Lists
--------------------------------------------------------------------

Fat City Network Services    -- (858) 538-5051  FAX: (858) 538-5051
San Diego, California        -- Public Internet access / Mailing Lists
--------------------------------------------------------------------