Monday, February 26, 2007

SOX is the New ISO

My current client has recently switched from using Source Safe as it's source code control utility, to Source Gear Vault, and has run into many problems with it.  Personally I'm not a big fan so far, but that's not to say it isn't a bad tool.  For one, it seems to be tied to directly to .NET projects only.  For instance, it seems to want to enforce particular standards regarding how your project is setup, that aren't really necessary.  A source code control tool shouldn't care why particular files are in a certain directory.  It should only care about moving them in and out of that directory, and controlling versioning.  It also seems to have a lot of speed issues.

But that's really not the point of this post.  While discussing the problems with Vault, I happened to ask someone why we chose Vault over other offerings, such as CVS.  I'm all for getting rid of Source Safe, but there are a lot of choices out there.  His response was "because it's SOX Compliant."  Huh?  SOX Compliant?  What does that mean?

SOX is short for Sarbanes-Oxley, and is a set of laws regarding accounting standards passed in 2002.  What does that have to do with source control, and more importantly, how can a control system become compliant, or not be compliant?  He shook his head.  He had no idea, he was just repeating what he was told.  And there in lies the beauty.

Back when I worked for an engineering and manufacturing company, we were very concerned about ISO 9000 compliance.  It became the buzzword, and excuse for everything.  "Because of ISO" or "For ISO" was repeated more times than I care to recall.  ISO compliance was taken so seriously there, that nobody argued with you when you brought up those magical letters.  It was a quick way to shut down debate.  SOX has become the new ISO.  Anytime you want to push something through, or don't want to explain why you have chosen to do something, all you have to say is "Because of SOX".

The reality is that SOX doesn't care how you manage your code.  But if you don't want an argument, talking about SOX compliance is a sure fire way to get your way.

#    5:35 PM by Nick | 1 Comment |