Several SOX challenges can affect a company’s ability to maintain an effective controls framework, or potentially hinder its ability to demonstrate that its ICFR efforts serve their intended purpose.
Common SOX Challenges
1. A lack of executive or board support for the organization’s SOX program.
Management’s commitment to effective controls and financial reporting is a key component to a SOX effort receiving the required time and attention.
2. Failing to take a true risk-based approach.
It’s essential to understand the company’s risks and to design controls to mitigate those risks, rather than treating SOX as a check-the-box compliance exercise.
3. Over-engineering process documentation.
Concise documentation that helps staff members and external auditors understand the thinking underlying a process is more effective than trying to capture every potential contingency and nuance (which can divert attention from more important activities).
4. Confusing operational controls with financial reporting controls.
Along with ensuring the data is accurate, you need to verify that the process used to generate that data is operating effectively.
5. Infrequent and superficial coordination with external auditors.
Management and external auditors should understand the company’s risks to evaluate better the design and the effectiveness of the controls designed to mitigate those risks. Nobody should be surprised during the audit process.
6. Having control owners believe control ownership is separate from day-to-day activities.
This is typically a culture issue, but team members responsible for controls may not integrate risk and performance of controls as part of their typical activities.
7. Underutilizing IT and application automation and configurations.
Control activities performed manually, on a repetitive basis come with a greater cost and increased risk of error, when compared to automated controls.
Understanding the requirements of SOX 404(a) and 404(b) and communicating frequently with external auditors about the design and performance of your controls are cornerstones of effective risk management and SOX compliance. Knowing these SOX challenges can help a company with its compliance journey.
For questions or more information about SOX compliance, visit our SOX services page or contact our team.
