Curated for content, computing, and digital experience professionals

Day: February 4, 2005

Making Compliance Sustainable

A few weeks ago Deloitte published a really useful, short whitepaper titled
"Under
Control: Sustaining Compliance with Sarbanes-Oxley in Year Two and Beyond
." 
(You can download the paper for free, but access requires registration.)

Recognizing that meeting first year SOX 404 compliance requirements was a
real fire drill for many companies, the paper asks the important question of how
to turn this into something that is sustainable.  You should download and
read the full paper, but I will pull out a couple of observations that seemed
particularly important:

  • Many companies approached their initial SOX compliance efforts as a
    "project."
      To the extent that the project focus helped
    meet the deadlines, it was a good thing.  But it is also a potentially
    crippling
    attitude that companies must consciously undo over the coming
    year.  Internal control and SOX compliance requirements never
    end.  They need to become part of daily operations, not a special
    project.  Facing the need to  "change gears" squarely
    will be important.
     
  • The internal audit team often emerged as a central part of the
    compliance "project" in year one.  That made sense for the
    first year, but may not be the right approach over the long
    run.  Without more staff and resources, continued work on SOX would
    displace important internal audit work.  Perhaps even more critically,
    if if internal audit becomes responsible for implementing and managing
    controls, they will not be in a position to provide an objective
    evaluation of those same controls
    .
     
  • Information technology was often not well integrated into first year
    compliance
    efforts — the focus was on meeting the deadline, not on
    building a workable, sustainable system.  Many companies will find that
    it is possible to make the process more efficient and sustainable by
    making strategic technology investments
    .

The paper is a nice overview of the problems faced by companies now that
initial deadlines have been met.  It is the kind of paper that I put in my
files for future reference.

Making Compliance Sustainable

A few weeks ago Deloitte published a really useful, short whitepaper titled “Under Control: Sustaining Compliance with Sarbanes-Oxley in Year Two and Beyond.” (You can download the paper for free, but access requires registration.)

Recognizing that meeting first year SOX 404 compliance requirements was a real fire drill for many companies, the paper asks the important question of how to turn this into something that is sustainable. You should download and read the full paper, but I will pull out a couple of observations that seemed particularly important:

  • Many companies approached their initial SOX compliance efforts as a “project.” To the extent that the project focus helped meet the deadlines, it was a good thing. But it is also a potentially crippling attitude that companies must consciously undo over the coming year. Internal control and SOX compliance requirements never end. They need to become part of daily operations, not a special project. Facing the need to “change gears” squarely will be important.
  • The internal audit team often emerged as a central part of the compliance “project” in year one. That made sense for the first year, but may not be the right approach over the long run. Without more staff and resources, continued work on SOX would displace important internal audit work. Perhaps even more critically, if if internal audit becomes responsible for implementing and managing controls, they will not be in a position to provide an objective evaluation of those same controls.
  • Information technology was often not well integrated into first year compliance efforts — the focus was on meeting the deadline, not on building a workable, sustainable system. Many companies will find that it is possible to make the process more efficient and sustainable by making strategic technology investments.

The paper is a nice overview of the problems faced by companies now that initial deadlines have been met. It is the kind of paper that I put in my files for future reference.

© 2020 The Gilbane Advisor

Theme by Anders NorenUp ↑