Rising SOX Compliance Hours and Costs Underscore Need for Technology Enablement

The twelfth annual Sarbanes-Oxley (SOX) Compliance Survey, conducted by global consulting firm Protiviti, finds that 65% ofrespondents who reported an increase in their SOX compliance hours said those hours increased by more than 10% over the prior year. Rising SOX compliance hours coupled with the COVID-19 pandemic accelerated the continued need to deploy technology and automation within compliance processes as well as to look for synergies with other organizational initiatives to enable greater efficiencies.

While most organizations continue to spend more hours on their SOX compliance activities year-over-year, “digital leaders,” – those organizations that have higher levels of maturity in the use of technology and innovative practices – have reported experiencing a lesser impact of increasing hours, which suggests they are gaining advantages through their greater use of technology (including automation) in the SOX compliance process. Fifty-one percent of survey respondents utilized technology tools, such as automated workflow technology and audit management software, in the testing of controls for their fiscal year, marking a yearly increase of 5%. Still, many companies, even digital leaders, are early in their adoption of technology and will continue to realize more efficiencies going forward.

Overcoming Adoption Hurdles

The survey reveals that while 78% of digital leaders have moderate to significant plans to further automate their manual processes and controls within their fiscal year, the same is true for only 57% of “digital laggards.” The findings uncovered the top challenges inhibiting these organizations from deploying automation in their SOX compliance processes, including: lack of time to spend on exploring automation; the misconception that certain areas of the SOX control environment are not conducive to automation; and a lack of funding and executive support.

“While audit teams are eager to make SOX compliance and other regulatory requirements less manually intensive through automation so that they will have more capacity to focus on higher-level strategic tasks, we’re finding that the majority don’t know where to start, especially without buy-in from their senior leaders,” said Brian Christensen, executive vice president and global leader of Protiviti’s internal audit and financial advisory practice. “We’ve found that the best way to begin and demonstrate the clear, bottom-line value that automation tools deliver in regulatory compliance processes is to start small: identify a simple, small-scale process to automate and present the use case to leadership to pave the way for broader applications across the organization.”

Among the survey respondents currently leveraging technology in their organization’s SOX compliance processes, the following applications –‑ given their simplicity and accessibility – were indicated to be optimal starting points to equip SOX compliance teams with positive use cases:

IT application controls (43%)
Accounts payable process (42%)
IT general controls (41%)
Account reconciliation process (37%)

“In addition to these use case areas, we find that organizations realize benefits through automation in other areas, including evidence gathering and interactions with audit, risk and compliance platforms – for example, in uploading completed work papers and evidence documents,” said Andrew Struthers-Kennedy, a Protiviti managing director and leader of the firm’s IT audit practice.

“SOX teams should take every opportunity to explore and evaluate how to make increased use of data and technology. Organizations that have committed time and effort to doing this have been able to realize a broad range of benefits beyond efficiency improvement, including increased coverage, real-time monitoring capabilities, talent upskilling and team member job satisfaction, to name a few,” added Struthers-Kennedy.

The Protiviti report, titled “SOX Compliance and the Promise of Technology and Automation,” is based on a survey of more than 650 audit, compliance and finance leaders and professionals, representing a wide range of industries. The survey was conducted with support from AuditBoard, a leading cloud-based audit, risk and compliance management platform, during the first quarter of 2021. Protiviti and AuditBoard formed an alliance in 2019 to collaborate in providing organizations with a comprehensive solution of software, consulting and thought leadership for advancing their SOX and internal audit initiatives.