As CAE or CFO, you’ve worked hard every year to optimize your organization’s SOX management and ensure your external audit goes smoothly. But with many businesses still experiencing rising costs and hours spent on SOX, as evidenced in the latest Protiviti SOX survey, simply avoiding failure is no longer a good enough metric for success. Your investment in managing SOX should provide your business with long-term benefits beyond simply avoiding material weaknesses each year, but how do you measure that success? The question is, how can you measure this impact? What changes in an organization when SOX is managed efficiently?
The 5 Outcomes of SOX Success
Organizations that are managing SOX effectively and continually improving their processes should see improvements in the following five areas. If some or all of these areas are static or declining in quality, it is a sign that your current investment is not paying off.
1. Improved Control Environment
Ongoing investment into a SOX program should result in an improvement in your actions, policies, and procedures. A prime example is if you have established and refined a clear walkthrough procedure and planned for upcoming environmental changes, then you will have less documentation changes and error corrections at a later date. Not only will you be better prepared for upcoming process changes, but the changes will happen more efficiently as well.
As the control environment improves, businesses should also see a clear increase in the level of automation and a corresponding decrease in the amount of manual testing required of auditors. As the level of automation increases, Internal Audit productivity increases, and businesses should start coming in under budget over time. Ultimately, this will result in your team spending less time managing fewer issues. Deficiencies should be reduced to an acceptable and predictable level, and there should be few surprises.
How has your control environment improved over time? Is the number of issues you deal with every year reducing or increasing?
2. Improved Documentation
Over time, a successful SOX process will improve documentation quality and efficiency. A business should see a reduced number of exceptions, and as a result, fewer deficiencies. In addition to a measurable boost to Internal Audit efficiency, your improved documentation will increase the level of trust external auditors place in the work of your Internal Audit team. Once greater confidence in the abilities of the Internal Audit team is established due to better documentation, external auditors will be more comfortable relying on their work, resulting in a reduction in external audit hours.
Have you seen an increase in the level of trust external auditors place in your Internal Audit team?
3. Less Redundancy and Higher Quality Controls
Most businesses begin their SOX journey with many unnecessary controls: often the same data will be reconciled twice, three times, or even more. This is not always necessary.
A successful SOX program will enable businesses to better understand and optimize their internal controls. Over time this should lead to consolidating and streamlining redundant controls. As a result of stronger and optimized key controls, efficiency is increased and businesses will experience cost savings. Additionally, as optimization occurs, the stronger controls will be those that can be automated. Reliance on purely manual controls will decrease, freeing up the Internal Audit team to deliver value in other areas.
How have your key controls become more optimized over time? Have you seen an increase in automation?
4. More Time to Add Value
With most Internal Audit teams heavily focused on SOX, many businesses can miss out on the important insights Internal Auditors can provide into their business processes. Because Internal Audit has contact with every area of your business, the team is in a unique position to advise management on operational improvements that can add value to your business.
If your SOX environment is strong and efficient, you should see a reduction in the percentage of time Internal Audit must allocate to delivering SOX. The Internal Audit team should have more time to commit to higher-value activities, such as cost reduction projects and operational improvements.
Is your Internal Audit team spending more or less or their time on SOX? Have they been able to deliver value in other areas?
5. Open Communication Between Internal Audit and Process Owners
Communication between Internal Audit and process owners should improve over time in a successful SOX program. A sign of SOX success is when Internal Audit can work in synergy with process owners, with minimal impact to their day to day activities. Another sign is when Internal Audit has done its research and is knowledgeable about the process before leading walkthroughs with process owners. On the other side, process owners should feel comfortable approaching Internal Audit with potential issues in their processes.
Each year, Internal Audit should be better prepared, building upon the baseline knowledge achieved through years of working closely with process owners to deliver a high-quality internal audit. Businesses should see a shift from an annual task to an ongoing conversation, with process owners consulting Internal Audit about process changes and issues on an ongoing basis. SOX success should lead to better relationships and fewer issues.
How has the communication between your IA team and process owners improved over time?
In conclusion, if you have taken the steps to ensure an optimized control environment and have invested the initial time and effort into a strong SOX program, not only will you experience these effects of SOX success, but you will continue experiencing these benefits over time. AuditBoard can help your organization build a strong control environment while improving efficiency. Created for internal auditors, by internal auditors, AuditBoard’s centralized database was purpose-built to help Internal Audit teams eliminate inefficiency, manage version control issues, drive efficient resource planning, and free up resource hours for more value-added activities. To learn more, visit our SOX management software product page.
Art Turrubiartes, CPA, is the VP of Product Solutions at AuditBoard. Before joining AuditBoard, Art was a Risk consultant at EY, and has 5 years of internal audit experience within the Technology and Media & Entertainment sectors. Art’s focus at AuditBoard is to help internal audit teams drive efficiency in their programs and ultimately provide the best product solutions to clients. Connect with Art on LinkedIn.
