SOX Compliance: Businesses see more internal scrutiny needed, and automated controls

When executives and professionals involved in SOX compliance were asked what was driving the most change in their SOX compliance processes, 66% said there was at least moderate change due to demand for increasing process and control documentation for high-risk processes. Additionally, 60% of respondents indicated that the increased amount of time required for walkthroughs and documentation around processes was also driving moderate change, according to findings in the 2013 Sarbanes-Oxley Compliance Survey by Protiviti.

"To continue to improve their SOX compliance efforts, companies need to intensify their scrutiny of high-risk processes such as financial reporting, accrual processes, stock options, and equity, and taxes," says Brian Christensen, Protiviti's executive vice president for global internal audit. "The study shows that companies are beginning to adjust in that direction and the shift aligns with guidance from the SEC and [the Public Company Accounting Oversight Board]."

"It's important to note that SOX compliance programs and processes should remain agile and ready to change course if public companies are to adhere to the law in an effective and cost-efficient manner," says Christensen.

Automation of controls continues to be an area of increased focus, with 90% of companies surveyed this year indicating that they have plans to automate IT processes and controls for SOX compliance, up from 83% in 2012.

With regard to the new COSO internal control framework, nearly two-thirds (66%) of the Protiviti survey respondents were aware of the revision process. [COSO is the Committee of Sponsoring Organizations of the Treadway Commission.] Not surprisingly, the vast majority (85%) were against early implementation in 2013. If given an adoption option, respondents were fairly evenly split across several potential implementation schedules, including fiscal year 2014 and adoption after 2014.

Year-over-year findings about which area within an organization is responsible for overseeing SOX compliance showed a sizeable shift toward the internal audit function and away from project management. In 2012, the survey found that 30% of organizations housed this responsibility with the internal audit function, while 25% handled SOX compliance through their project management office. However, in this year's survey, 45% of respondents said internal auditing managed SOX compliance (up 15%), while only 10% said it was handled by project management (down 15%).

One reason for this shift is the willingness of external auditors to rely on the work of internal audit departments rather than other functions. In 2013, only 25% of respondents said there was an increase in external auditors' reliance on documentation, walkthroughs, and testing performed outside of the internal audit function, while 39% said there was an increase from external auditors in having the same work done by internal audit departments.

Other key findings from Protiviti's 2013 Sarbanes-Oxley Compliance Survey include:

• Eighty percent of respondents indicating they have seen improvements in internal control over financial reporting structure since Sarbanes-Oxley Section 404(b) was first required for large accelerated and accelerated filers in 2004. This is especially true for large accelerated filers, with 87% saying there have been improvements.

•  More than one-third of companies (38%) reporting a year-over-year increase (from 2011 to 2012) in SOX costs. Nearly half of the companies surveyed (47%) also reported a year-over-year increase in external audit fees during the same period. That said, on average the costs for SOX compliance are not extraordinarily high relative to the objective of quality financial reporting to investors through improved internal controls. For most organizations, the cost of SOX compliance remains at a manageable level.