Leading practices for year one
Organizations about to embark on their year-one SOX journey should start by establishing a governance structure that sets clear lines of responsibility and follows a two-pronged approach. The first step involves setting up a steering committee, independent of control owners, to oversee the project. The second step identifies key business process and IT stakeholders who will serve as control owners and execute the program.
As the SOX program progresses, the organization should establish materiality thresholds and identify significant accounts, major processes, and opportunities to team with the external auditor to confirm both the approach and scope.
The organization should also implement Section 302. In addition to annual certification by the chief executive officer and chief financial officer, this encourages a bottom-up approach in which the control owners also certify on a regular basis the design and effectiveness of the controls for which they oversee. This process typically follows a quarterly cadence and places controls at the forefront to alert the internal audit and internal controls team of a change or potential issue.
As the organization starts the next phase, the internal controls team should interview key business process and IT personnel to document entity-level controls. This helps identify in-scope financial and IT systems and processes. As this work is performed, control gaps are identified and addressed, leading to the development of a robust Risk and Control Matrix (RCM) and process flows narrative.
The SOX assessment concludes with validation of results, proposed recommendations for deficiencies and analysis of action plans. This is followed by a report to management on the program status and a plan to communicate and coordinate with the external auditor. At this stage, an organization will essentially be operating as fully compliant with SOX.
Common pitfalls leading to deficiencies
In the rush to go public, some companies may find themselves trying to adopt a risk framework that may not be tailored to their specific needs. Accurately evaluating the risk universe before implementing the RCM and associated controls minimizes the likelihood that a severe deficiency could be designated as a material weakness. Additional layers include performing a gap analysis, benchmarking against similar organizations, and using leading practices from professional and regulatory bodies.
To further this approach, the internal controls team needs to train control owners and those charged with governance regarding the importance of documentation and maintenance of control design. This empowers these key players to “own” the control framework and follow through on proper execution.
The SOX team should also deploy a robust change management protocol to identify key system, policy, procedure and/or owner changes. This provides an opportunity to collaborate with business and IT teams prior to implementation. Engaging process owners from IT, internal audit and internal controls sets the stage for open discussions on the impact to the controls and financials.
At this stage, organizations can start mock stress tests. Working toward compliance prior to the IPO enables organizations to perform full life-cycle testing one year before the external auditor issues an integrated audit opinion. This offers assurance that the controls framework functions as intended and provides adequate time to remediate deficiencies.
Organizations may also want to consider relying on technology to streamline the effort needed to become SOX-compliant. The proprietary EY platform Virtual Internal Auditor (VIA) provides an avenue for both controls testing automation and optimization. By creating analytics scripts, workflows and a centralized repository, organizations can perform automated testing that standardizes the approach for continuous testing and reduce the manual efforts. As the internal controls’ framework matures, VIA also contains an optimization functionality that can allow organizations to enhance their control universe and rationalize out redundant controls to drive down their overall cost of SOX compliance.
Benefits of becoming SOX-compliant
SOX compliance represents a major undertaking for any organization. Each entity should consider the resources available for not only the design and implementation of compliance efforts, but also for maintaining future state compliance.
Becoming SOX-compliant can be time-consuming and expensive. As they prepare for SOX, organizations may opt to bring in a qualified team of professionals to help develop and maintain their program. This will not only expedite the process, it will also offer additional comfort with respect to regulatory compliance.
These steps often serve as a springboard for IPO success, particularly as investors place a higher valuation on companies with established controls. Even more, preparing for SOX can position a business for profitable, sustainable growth in the years ahead.
