ITEM 4. CONTROLS AND PROCEDURES

We maintain “disclosure controls and procedures” within the meaning of Rule 13a-14(c) of the Securities Exchange Act of 1934, as amended, or the Exchange Act. Our disclosure controls and procedures, or Disclosure Controls, are designed to ensure that information required to be disclosed by Altiris in the reports filed under the Exchange Act, such as this Quarterly Report on Form 10-Q, is recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms. Our Disclosure Controls are also designed to ensure that such information is accumulated and communicated to our management, including our Chief Executive Officer and Chief Financial Officer, as appropriate, to allow timely decisions regarding required disclosure. In designing and evaluating our Disclosure Controls, management recognized that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving the desired control objectives, and management necessarily was required to apply its judgment in evaluating and implementing possible controls and procedures.

Table of Contents

Evaluation of Disclosure Controls and Procedures . As of the end of the period covered by this Quarterly Report on Form 10-Q (the “Evaluation Date”), we evaluated the effectiveness of the design and operation of our Disclosure Controls, which was done under the supervision and with the participation of our management, including our Chief Executive Officer and Chief Financial Officer. Included on Exhibits 31.1 and 31.2 of this Quarterly Report of Form 10-Q are certifications of our Chief Executive Officer and Chief Financial Officer, which are required in accordance with Rule 13a-14 of the Exchange Act. This Controls and Procedures section includes the information concerning the controls evaluation referred to in the certifications and it should be read in conjunction with the certifications for a more complete understanding of the topics presented. Based on the controls evaluation, our Chief Executive Officer and Chief Financial Officer have concluded that, as of the Evaluation Date, our Disclosure Controls were effective to ensure that material information relating to Altiris and its consolidated subsidiaries would be made known to them by others within those entities.

Changes in Internal Control over Financial Reporting . In our ongoing effort to improve business and operational processes, we developed a new license management portal (“LMP”) that automates the generation and delivery of license keys based on orders received and processed. The LMP went into production during the quarter ended September 30, 2004. The implementation of the LMP during the quarter led to internal systems errors that delayed the shipping of license keys on orders received late in the quarter, which resulted in a deferral of license revenue to the following quarter. This implementation, with the resulting systems errors, materially affected our “internal control over financial reporting” (as defined under Rule 15d-15(f) of the Securities Exchange Act of 1934, as amended) during the quarter. In connection with our evaluation of changes to our internal control over financial reporting required by Rule 15d-15(d) of the Exchange Act, and in the process of investigating the systems errors, management has identified certain control deficiencies in our internal control over financial reporting relating to the systems errors, including control deficiencies involving the lack of: (i) restrictions on access to effect development level changes to our financial systems and applications in a production environment, and (ii) limitations on user access into our financial systems, applications and data. Since identifying these control deficiencies, we have taken steps, and we may yet identify additional steps, to make improvements to our internal control over financial reporting that we believe will remediate these control deficiencies and enhance the reliability of our internal control over financial reporting.

Pursuant to the Sarbanes-Oxley Act of 2002 and rules of the Securities and Exchange Commission promulgated pursuant to that act, our management will be required to evaluate the effectiveness of our internal control over financial reporting as of December 31, 2004, and we are required to disclose management’s assessment of the effectiveness of our internal control over financial reporting, including any “material weakness” (within the meaning of Public Company Accounting Oversight Board (“PCAOB”) Auditing Standard No. 2) in our internal control over financial reporting. If our management concludes that there are one or more material weaknesses in our internal control over financial reporting, our management will not be permitted to conclude that our internal control over financial reporting is effective. It is possible that the control deficiencies identified above or other control deficiencies, either individually or in combination, constitute “significant deficiencies” (within the meaning of PCAOB Auditing Standard No. 2) or material weaknesses in our internal control over financial reporting. As a result, if we fail to adequately remediate these control deficiencies before December 31, 2004, and if management or our auditors conclude that they give rise to or otherwise constitute material weaknesses, our management will not be permitted to conclude that our internal control over financial reporting is effective.

26

Table of Contents