How to unlock value from your SOX program beyond compliance

Driving value in your SOX program begins with understanding the challenges happening today and transforming for what happens tomorrow.

There’s no question that the business landscape has changed significantly since the initial passage of the Sarbanes-Oxley Act (SOX) in the United States in 2002, and the pace of change and disruption in today’s environment is even more accelerated. Rapid convergence of industries, new business models, increasing regulation and an evolving workforce are all underpinned by advances in technology. Groundbreaking discoveries such as artificial intelligence and robotics bring about increased efficiency while introducing new and heightening current risks.

The global SOX survey conducted by EY examined how businesses manage SOX, what challenges are being faced and how technology is being used and is further discussed in our report Unlocking value beyond compliance in your SOX program (pdf). The survey results included over 300 respondents from a wide range of publicly traded companies of various sizes from around the world, of whom 80% have had to comply with SOX or similar legislation for more than five years.

Where we are today

By its very nature of being a legislative requirement, SOX is viewed as a compliance effort at its core. However, SOX can add value to a company if the objectives are focused in the right places: 42% of respondents have experienced an improved internal control environment, 28% believe they have better risk control, and 25% have streamlined control activities.

The EY survey uncovered three common themes and opportunities:

• Importance of strong, connected governance and oversight
• Responsive and risk-based operating model enabled by technology
• Continuous program improvement

This is a simple example to highlight a complex issue. Transforming your SOX program is not a one-time, big-bang exercise, but an ongoing opportunity to do better and be better. The road map will not be the same for every program, but it is important to have a formal plan with targeted goals and action plans.

What can you do today to catch up to tomorrow?

• Evolve your operating model: keep pace with the changes in your organization through a flexible and dynamic approach to managing and evaluating internal controls
• Explore new ways to innovate through technology: consider enhancing automated capabilities across all aspects of SOX, such as digital risk assessments, automated scoping tools and analytic testing procedures
• Upskill your workforce: look for new opportunities to cross-train on business processes and IT general controls; refresh control owner training and feedback processes
• Build trust with the business: ask for feedback on the SOX program; consider using an impartial third party (internal or external) to gather feedback; develop a plan and take action
• Challenge the nature, timing and extent of testing: ask whether you are doing too much in any area or not enough in another; determine whether control classifications are accurate and aligned to the appropriate risks (manual vs. automated)
• Consider a facilitated visioning session: focus on governance structure, operating model, talent pool, use of technology and strategy