2018 Sarbanes-Oxley Compliance Survey
The Sarbanes-Oxley Act, a watershed law that affected nearly all publicly held companies soon after it was enacted in 2002, continues to make waves for organizations, particularly given the broad range of changes and influences impacting compliance efforts.
From new accounting standards for revenue recognition and lease accounting to ongoing inspections of external auditors by the Public Company Accounting Oversight Board (PCAOB), the landscape for SOX compliance continues to shift for a law that was expected to evolve into a relatively stable compliance exercise for affected companies.
Changes continue to influence SOX compliance efforts, but the areas of most significant concern have been consistent for years: costs, hours and control counts. In addition, organizations are asking more questions about opportunities to increase their use of automated controls and employ more robotic process automation (RPA) into their compliance efforts. We present data points and insights on these and numerous other SOX issues in our 2018 Sarbanes-Oxley Compliance Survey.
Key findings include:
- Compliance costs continue to rise for many organizations but remain dependent on size, SOX year, filer status and more. Many organization experienced increases in their SOX compliance costs during their last fiscal year, and those spending $2 million or more grew as well. However, annual compliance costs did decrease from the prior year for certain groups of companies.
- SOX compliance hours have increased significantly. There are likely many factors at play here, including changing organizational structures resulting from ongoing digital transformation efforts, as well as continuing PCAOB inspections of external auditors that are placing increased demands on their clients to perform more rigorous SOX compliance testing and reporting.
- The use of automated controls testing and RPA remains low. Implementing these technologies represents a significant opportunity for organizations to build efficiencies into the SOX compliance process and, over the long term, potentially reduce the costs and hours incurred, as well as introduce overall improvements to the control environment.