“Next-generation” SOX compliance programs are prioritizing automation and technology enablement, alternative resourcing models, and standardized controls across locations.
As noted in Protiviti’s annual Sarbanes-Oxley Compliance Survey, the aforementioned areas to prioritize are some of the ways SOX is evolving after having been in effect for more than two decades.
Consider the possibilities — Few board members and C-suite leaders view SOX compliance as a hotbed of opportunity for process innovation or leading-edge technology. That may be a mistake.
Why it matters — Automation and technology enablement, resourcing models that include outsourcing and offshoring options and centers of excellence, and greater use of standardized controls across the organization are proving to be foundational elements of a “next-generation” SOX compliance program.
Our survey results find that a growing number of organizations are investing in automation, as well as advanced and enabling technology solutions to support their SOX compliance activities (see graphic below).
Are you seeking opportunities to further enable automation of your SOX compliance program?
But it’s not just about technology — External factors impacting SOX compliance activities, such as the SEC’s recently adopted rules around cybersecurity disclosures, the PCAOB’s annual inspection process of external auditors, and the SEC’s proposed climate change disclosure rules, highlight the broader and changing landscape of non-financial data reporting and how organizations are preparing for it.
By the numbers — Our SOX Compliance Survey provides detailed benchmarks for compliance costs and hours, while quantifying the impact of technology, automation and changing business conditions on these measures and activities. Among the key takeaways:
- SOX costs per location are trending down, although overall program hours continue to climb.
- 63% of SOX compliance programs use an audit management and GRC platform to enable their SOX compliance programs.
- 37% of organizations disclose ESG metrics and apply ICFR-type processes to that information.
- 41% of organizations issued some form of a cybersecurity disclosure in 2022.
Interested in learning more? Our survey report is available here.
AuditBoard, a leading cloud-based audit, risk and compliance management platform, collaborated on the 2023 Sarbanes-Oxley Compliance Survey questionnaire and report. Protiviti and AuditBoard formed an alliance in 2019 to collaborate in providing organizations with a comprehensive solution of software, consulting and thought leadership for advancing their SOX and internal audit initiatives.
