[arin-ppml] Does this apply to Transfers too?

[Craig Finseth]

	...
   I don't expect any corporate officer to sign off on this
   kind of attestation until after the stock of IP addresses
   is audited by someone competetent, i.e. an accountant who
   has audit training. This means that if you work in a network
   group that has been flying under the radar for years,
   managing IP addresses as some minor netops technical detail,
   life is about to get interesting.

   And don't bother sneering at those accountants and making
   smart remarks about how little they understand networks.
   They don't need to. They will want to see your records,
   understand your recordkeeping procedures, and make sure that
   you really do know how many IP addresses are in use, how
   many are unavoidably wasted for technical reasons, and how
   many are in limbo due to customer churn or network redesign.

   In fact it would be useful if ARIN would produce some documentation
   targeted at CPA auditors, that explains how to audit IPv4 addresses.
	...

I am excerpting and repeating this message from Michael Dillon because
it is all but impossible to underemphasize how important it is.

If you're operating with full ITIL-level processes and complete
recordkeeping, you're fine.  This will cover about 10 organizations
out there.

If you're like the rest of us, your IP address management is not up to
par.  You're going to spend a lot of time with auditors going over
what you are doing and why you are doing it.

Also, when was the last time you audited your routing tables against
your IP address management database (err, spreadsheet)?  Yup, you get
to do that, too.

And I would like to underscore the request for ARIN to produce the
documentation for auditors.  It will help us all immensely.

Craig