Upgrading Your SOX Testing Program with Automation Technology

For businesses with a December 31st FYE, Q4 is often a busy period of shepherding the final rounds of SOX testing across the finish line. Coincidentally, this season is an optimal time for SOX practitioners to begin strategizing ways to improve their SOX programs for the upcoming year. This is because the final months of the SOX year can often clue SOX practitioners in to the areas and processes most in need of improvement.

Although last-minute surprises when consolidating issues are highly unwelcome at this stage of the year, they can be a good indication of the overall health of your SOX program. Weak or lacking areas in staff, budget, and technology are also likely to be cast in sharper relief as testing deadlines approach. Yet, most SOX practitioners are too preoccupied or exhausted in the final months of the year to analyze such considerations in preparation for the new year.

Alleviating SOX Pain Points Year-End and Year-Round

Companies that have adopted SOX management solutions are well-positioned to start automating control testing, evidence collection, and document management. A 2021 AuditBoard poll of 860 SOX teams revealed that 97% of teams who implemented a cloud-based SOX solution experienced one or more of the following efficiencies in their SOX testing program: improved productivity, elimination of version control issues, and real-time reporting.

Despite this, internal auditors and SOX practitioners have been slow to adopt the next-generation technologies widely available to them. According to Protiviti’s 2021 SOX Compliance Survey, 51% percent of respondents utilized technology tools, such as automated workflow technology and audit management software, in the testing of controls for their fiscal year. This indicates the remaining 49% of SOX teams are still managing their programs using traditional methods, despite their associated administrative pain points, e.g., version control issues, manually updating controls data, and manual reporting.

5 Leading Practices for SOX Teams to Prepare for Digital Transformation

If your SOX department is still managing its program using outdated technology and would like to introduce upgrades, the first step is to identify the obstacles to digital adoption. According to Protiviti, the top challenges preventing SOX departments from utilizing newer automation technologies are:

1. Overall effort to research and implement a technology solution.
2. The belief that many areas of SOX are not conducive to automation.
3. A lack of funding and/or executive buy-in.

Once you have a solid grasp of your department’s specific challenges, you can begin to address them.  Brian Christensen, Protiviti’s Global Head of Internal Audit, suggests building a case for technology by starting small:

“Identify a simple, small-scale process to automate and present the use case to leadership to pave the way for broader applications across the organization.”

For SOX teams in the early stages of their automation journey, here are five additional ways to pave the way for digital transformation.

1. Define Your Objective

Before you even start looking at audit management solutions, understand where your business is going, if and how it is already leveraging transformational technologies, and ultimately what you would like to achieve within your SOX program.  Setting small, achievable goals within defined sprints will go a long way to attain your larger objective, and will give you the flexibility to adapt or change paths if things aren’t working out.

2. Ask for Help

If your organization has a data analytics and RPA Center of Excellence or related resources — use them. Better to start small with a basic proof of concept built on borrowed technology than to go all-in on a digital initiative — only to realize your hypothesis on time savings is way off. Tap into relationships with your SOX and audit network and local chapter meetings — and even software vendors. If your business is important to them, they’ll be eager to demonstrate how they can automate your control test or evidence collection process.

3. Understand the Data

Understanding the flow of transactions and key financial reporting data structures within your organization will rapidly accelerate your success. Ultimately, a solid transformation strategy will reduce the barriers and friction caused by the SOX evidence collection process and lay a strong foundation for leveraging data in automated control testing. When source system data is difficult to extract or too complex to interpret — call in help. For example, deciphering role-based access in most ERPs requires the use of a specialist, specialized software, or both; don’t be afraid to use these resources and integrate them into your automation strategy.

4. Explore What’s Possible

There are multiple ways to perform a control test or automate manual processes; therefore, exploring the most efficient and effective approach is encouraged. Once you have the data and a foundational knowledge of a software solution’s capabilities, you will quickly realize the many ways you can extend your analysis to gain insights into the business or simply test a control more efficiently and effectively. Don’t be afraid to validate your approach and documentation methodology with your external auditor — they are eager to leverage your work and are making significant investments in these exact same technologies.

5. Report and Celebrate Results

Making the choice to embark on digital transformation takes courage and determination. In the beginning stages of technology implementation, promote your efficiency gains to help boost momentum and buy-in. The organizational impact of these technologies is significant, and you will need all the self-promotion and internal support you can get. Moreover, reducing your team’s and control owners’ SOX audit fatigue by automating previously manual processes is a significant accomplishment — and should be measured and celebrated accordingly.

For SOX and audit practitioners seeking other practical ways to streamline their SOX processes, download the full SOX Management Playbook to learn how to build a more informed, effective, and efficient SOX program using a risk-first approach.