Scrum Compliance

Question

Question: Is Scrum compliant with SAS and Sox?

I am new to Scrum and have been a PM most of my career. I understand having the proper documentation for audits relating to SAS/Sox inregards to tradtional PMO. I know that Scrum eliminates much of the PM type of documents and classifies them as waste but I would expect a auditor to look for certian documents relating to development and changes to systems.

Is there a guideline for SAS/Sox compliance in the Scrum world? Checklists? Anything that anyone could recommend would be helpful.

Answer 1

"Is there a guideline for SAS/Sox compliance?"

Follow that doing the absolute minimum. Don't invent workflows. Don't make developers jump through hoops.

Nothing stops you from documenting.

Scrum advises you to get out of the way of your development team, and reduce the burden on them.

If compliance is necessary, find the minimum and do that well. If it's a deliverable, then it's probably part of a release sprint.

The mistake is elevating "compliance" so that it becomes a burden and a distraction.

Answer 2

SAS is just concerned with having a documented process and following it. So if you write down scrum, and your team indeed practices scrum, then you should pass a SAS audit. I'm pretty sure just about any methodology can be SAS certified. I worked for a SAS70 compliant firm and we had said that "a design document" would be in a certain folder. We never said that it had to reflect the actual implemented design. So we just tossed stuff in there that looked like it might be an ok design, titled it "design document", and passed our audit with no problem.

Answer 3

Scrum can be as high or low ceremony as you like. I.e. if you need to document everything you do in triplicate, or jump through loads of firey hoops to get to "done" for each story then that's fine; Scrum can handle it. Just make sure that your backlog tasks, definition of "done" and estimates reflect this increased work you'll have to do.