Two decades after passage of the Sarbanes-Oxley Act, public companies are spending more time and money trying to comply with SOX requirements, despite the increasing use of technology to automate the process.
A
An average of 41% of surveyed organizations’ SOX compliance costs are for outsourced resources, either onshore or offshore, up from 37% in 2021. Companies use technology tools on an average of 25% of their overall SOX compliance program activities, leaving significant room for improvement.
SOX was passed by Congress in 2002 in the wake of a series of high-profile accounting scandals at companies including Enron, WorldCom and Tyco. The law required public companies to set up internal controls over financial reporting that would be signed off on by top executives and auditing firms, and established the Public Company Accounting Oversight Board to set auditing standards and inspect the work of audit firms.
Despite improvements in SOX and auditing technology in recent decades, costs keep going up. The survey found that for companies that are beyond their second year of SOX compliance, average annual costs for SOX compliance rose 18% from 2021 to 2022. Thirty percent of surveyed companies beyond their second year of SOX compliance spent over $2 million in their most recent fiscal year, compared to 24% the previous year.
“Today internal audit and finance leaders have a menu of options available to innovate and streamline their SOX compliance programs and lessen internal burdens, from technology tools that support automation, provide workflow capabilities and support document management, to alternative delivery models, such as centers of excellence managed internally or by an external outsourcing partner,” said Andrew Struthers-Kennedy, a Protiviti managing director and global leader of the firm’s internal audit and financial advisory practice, in a statement. “The ongoing war for talent underscores the urgency for internal audit leaders to explore the staffing and retention advantages that alternative service delivery models can yield. Delivery center organizational structures offer internal audit teams the ability to focus on strategic contributions and avoid burnout and turnover related to certain repetitive and routine SOX program activities.”
For an organization with 200 controls, a reduction of one hour in, for example, testing for operating control effectiveness can save 200 person hours and lead to significant benefits in effectiveness and population coverage, according to Protiviti.
Companies are turning to technology to try to make the process more efficient, with 54% of surveyed companies leveraging audit management and governance, risk and compliance (GRC) technology, while two out of five organizations are using data analytics and visualization platforms. One in three are employing segregation of duties analysis tools and continuous monitoring. But technology is only being used in about one out of four of their overall SOX compliance efforts on average.
