Ebay sales vs. Sox Compliance

[ian.mechura]

I have a question that's been bugging me for some time. 

How is it possible for a publicly traded company to sell merchandise on eBay without being in violation of the sarbanes Oxley (Sox). Given that eBay does not provide any systems functionality for separation of duties?

For instance an employee who had access to the eBay account (which would be required) would have unrestricted access to change the PayPal account to their own. Since there is no "ID per User" system, then there would be no specific audit information to track to that person so not only would it be illegal from the separation of duties standpoint, it would also fail to meet the auditing requirement that are required by law. 

[dhbookds]

Not sure I'm understanding.  Are you saying an Ebay employee could divert payments to their own paypal account, but there is no way to track/find out that?  Or perhaps you mean they could change any paypal account to their address? 

I feel confident that both ebay and paypal could track it and would hit the employee with theft charges..........  They discover/find out about account takeovers now, so don't see how this would be any different.........

[the*dog*ate*my*tablecloth]

It's not enough to change the email in the listings. You have to add the email address to the Paypal account. I don't remember Ebay employees ever having access to Paypal accounts, even when Ebay owned Paypal. They were essentially run as separate companies.

[gracieallen01]

I don't think the OP is talking about an account take over, as much as 'skimming' or 'utilizing for personal purposes' the account by an allowed employee who isn't actually identified as an authorized owner of the account - as one instance.  And, not necessarily an 'ebay' employee.

[nobody*s_perfect]

@dhbookds 

@the*dog*ate*my*tablecloth 

I think he's not referring to eBay employees, but to an employee of a company that sells stuff on eBay.  Any company that sells stuff on eBay must have at least one employee who sets up the content of the listings.  To divert funds, that employee would only need to change the email address in the payments section of the listing, changing it from the company's email address to an email address that is attached to the employee's personal PayPal account.  eBay has no mechanism in place to prevent this or even audit it.

I know absolutely nothing about auditing principles, but surely there should be some oversight within the company about whether the payments for their eBay sales were showing up in their PayPal account?

[the*dog*ate*my*tablecloth]

That would have to be a pretty **bleep** accounting department if they weren't comparing cash in to payment due.

[dhbookds]

Ah, that does make more sense......thanks, Nperfect.......can't find a short name for you, lol

Ebay was supposed to have a way for sellers to allow employees onto certain parts of the site but not others......I think that was promised for lst q of this year, last yr at Open.  Not here yet............but perhaps someday.......

Personally, I agree it should be the co that allows the employee to do the work on Ebay to be sure he isn't chiseling, but who knows what the laws are.  Certainly more than a few public companies have sold on ebay........

[goodluckselling]

This subject gets brought up frequently in the weekly chat and eBay has said they are working on gating areas within a seller account and that they are close to announcing a new feature like this.  I will assume the new managed payments has created a few hurdles for eBay in this area?

Good Luck Selling!

[dtexley3]

If the OP is referring to employees of the entity that owns the eBay account, they are not employed to eBay so SOX would not apply.  

If the OP is referring to employees of EBay then SOX would apply.  However, from our vantage point outside the system we have no way to know how effective, indifferent, existant or non-existant such controls are within eBay.  There is obviously some level of monitoring based on responses by blues on other threads.  Whether or not the level of monitoring meets SOX compliance would only be know within eBay (unless a fine was assessed by the government).