SOX Process Narrative vs. Flowcharts: Which Is Better?

SOX professionals are often asked to document business processes that involve SOX controls. Some departments rely heavily on process narratives, while some prefer to create flowcharts, and others choose to use both formats. Since creating and keeping these resources up to date is time-consuming, we need to know if there is a winner in the process narrative vs. flowchart debate. This article will consider the benefits of using process narratives, flowcharts, and a combined approach to documentation.

What Is a Flowchart?

Flowcharting has been the standard for process and control documentation for decades. The ability to visualize the complexities of a process from start to finish gives reviewers a better perspective so that they can determine if there are any areas to improve. Flowcharts create a consistent mechanism for understanding a process and controls in a simplified manner. The visual medium provides a structure to facilitate conversation about the end-to-end process. Risks and controls are easily identifiable in the flowchart, which makes this the preferred method for most auditors. Once created, flowchart maintenance can be a simple quarterly process that is included in many SOX solutions.

Flowcharting can present a few drawbacks. To start, flowcharting tools can be expensive, especially if you are purchasing software for many people. In some cases, sharing the flowchart may be dependent on everyone having the software. Once you have the software, there is the challenge that not everyone is comfortable with flowcharting — investment in flowchart training may be necessary.

What Is a Process Narrative?

The act of writing a process narrative is an extremely powerful tool. Having a process owner document the full scope of the process with the controls placed in the correct context facilitates a more detailed review by peers and auditors. Process narratives include more detail and remove ambiguity or room for interpretation. On the other hand, process narratives do take more time to create, review, and maintain. Like with flowcharts, many SOX compliance tools facilitate narrative updates as well. The process owners may also push back if they are concerned about their writing skills being judged by their peers and others. 

Is One Form of Documentation Better than the Other?

Looking across many SOX teams, a better practice includes a combination of both methods. When using both flowcharts and process narratives, you can benefit from the visual aspect of the flowchart with the advantage of adding context with a process narrative. In most cases, the flowchart is still focused on the overall process. At the same time, the narrative is kept shorter, considered supplemental in nature, and used to capture more nuanced areas of the process like any historical context or approved control exemptions. 

Ultimately the decision between process narrative vs. flowcharts is up to your organization. Once you weigh the pros and cons between the two options and a combined approach, you should choose the method that works best for your process owners, the SOX team, and any external reviewers for process and controls who may rely on the documentation.