Section 404 of the Sarbanes-Oxley act requires companies to attest to their internal controls. They are struggling with the extent to which IT is an issue. Of course, most systems are computerized and therefore IT controls are an important part of the overall system of controls. The problem is where and when. Also, there's a problem finding the expertise to answer these questions. IT role in Sarb-Ox problems is unclear - Computerworld