Rising SOX Compliance Hours and Costs Underscore Need for Technology Enablement, Finds New Protiviti Survey

COVID-19 remote work highlights opportunity for companies to relieve manual regulatory compliance processes through digitisation and technology adoption.

MENLO PARK, CA - June 15, 2021 – The twelfth annual Sarbanes-Oxley (SOX) Compliance Survey, conducted by global consulting firm Protiviti, finds that 65% of respondents who reported an increase in their SOX compliance hours said those hours increased by more than 10% over the prior year. Rising SOX compliance hours coupled with the COVID-19 pandemic accelerated the continued need to deploy technology and automation within compliance processes as well as to look for synergies with other organisational initiatives to enable greater efficiencies.

While most organisations continue to spend more hours on their SOX compliance activities year-over-year, “digital leaders,” – those organisations that have higher levels of maturity in the use of technology and innovative practices – have reported experiencing a lesser impact of increasing hours, which suggests they are gaining advantages through their greater use of technology (including automation) in the SOX compliance process. Fifty-one percent of survey respondents utilised technology tools, such as automated workflow technology and audit management software, in the testing of controls for their fiscal year, marking a yearly increase of 5%. Still, many companies, even digital leaders, are early in their adoption of technology and will continue to realise more efficiencies going forward.

Overcoming Adoption Hurdles

The survey reveals that while 78% of digital leaders have moderate to significant plans to further automate their manual processes and controls within their fiscal year, the same is true for only 57% of “digital laggards.” The findings uncovered the top challenges inhibiting these organisations from deploying automation in their SOX compliance processes, including: lack of time to spend on exploring automation; the misconception that certain areas of the SOX control environment are not conducive to automation; and a lack of funding and executive support.

“While audit teams are eager to make SOX compliance and other regulatory requirements less manually intensive through automation so that they will have more capacity to focus on higher-level strategic tasks, we're finding that the majority don’t know where to start, especially without buy-in from their senior leaders,” said Brian Christensen, executive vice president and global leader of Protiviti's internal audit and financial advisory practice. “We’ve found that the best way to begin and demonstrate the clear, bottom-line value that automation tools deliver in regulatory compliance processes is to start small: identify a simple, small-scale process to automate and present the use case to leadership to pave the way for broader applications across the organisation.”

Among the survey respondents currently leveraging technology in their organisation's SOX compliance processes, the following applications –‑ given their simplicity and accessibility – were indicated to be optimal starting points to equip SOX compliance teams with positive use cases:

• IT application controls (43%)
• Accounts payable process (42%)
• IT general controls (41%)
• Account reconciliation process (37%)

“In addition to these use case areas, we find that organisations realise benefits through automation in other areas, including evidence gathering and interactions with audit, risk and compliance platforms – for example, in uploading completed work papers and evidence documents,” said Andrew Struthers-Kennedy, a Protiviti managing director and leader of the firm’s IT audit practice.

“SOX teams should take every opportunity to explore and evaluate how to make increased use of data and technology. Organisations that have committed time and effort to doing this have been able to realise a broad range of benefits beyond efficiency improvement, including increased coverage, real-time monitoring capabilities, talent upskilling and team member job satisfaction, to name a few,” added Struthers-Kennedy.

The Protiviti report, titled “SOX Compliance and the Promise of Technology and Automation,” is based on a survey of more than 650 audit, compliance and finance leaders and professionals, representing a wide range of industries. The survey was conducted with support from AuditBoard, a leading cloud-based audit, risk and compliance management platform, during the first quarter of 2021. Protiviti and AuditBoard formed an alliance in 2019 to collaborate in providing organisations with a comprehensive solution of software, consulting and thought leadership for advancing their SOX and internal audit initiatives.

Survey Resources Available

The survey report is available for complimentary download here. Additionally, an infographic and a podcast featuring Protiviti’s Kristen Kelly, director, and Angelo Poulikakos, managing director, discussing key survey findings are also available on the web page. Protiviti and AuditBoard will conduct a free 60-minute webinar on June 17 at 10:00 a.m. PDT with Christensen and Kelly along with Scott Madenburg, market advisor, AuditBoard and Jeremy Wildhaber, director, Protiviti, to further explore the study’s results and the impact of the pandemic on SOX compliance processes.