This brute force solution captures the essence of how many organizations are approaching their compliance requirements. They are placing people, and often highly compensated ones at that, with fancy counters at the start of their business processes. Sometimes they may randomly scatter them through the park and at the exit as well. This approach meets the minimum set of standards required to keep the executives out of jail and comply with the mandate, but it really becomes more of a burden than a help to running the business.
One of the biggest problems with manual monitoring is that it is only as good as the people doing the reporting. In many of the recent scandals that caused Sarbox legislation to originally be introduced, there were records. They just weren't the records of actual events. Instead, at best, they had a loose relationship to real events, and at worst an anti-relationship to cover up improprieties. This prompts the question: Who watches the watchers?
Embedding monitoring in the processes through technology eliminates the chance of this revisionist history coming into play. Records are generated automatically as a result of performing the action, and reflect exactly what occurs. Once the records have been completed, they cannot be changed through normal means.
Think again about our amusement park. Instead of placing manual counters at the turnstiles, what if the turnstiles themselves did the counting and were connected electronically to a central aggregator? You would eliminate the cost of the people doing the counting, as well as the cost to manually tabulate the results at the end of the day. You would also improve the accuracy of the data, since electronic turnstiles don't get bored, don't fight with their spouses before coming to work and don't leave their posts for a lunch or washroom break.
You've now done a much better job of meeting the corporate mandate and considerably reduced the cost of compliance over the long term. But you still haven't truly leveraged the opportunity for change.
A Force for Acceleration
Newton's second law talks about the relationship between force, mass and acceleration. Likewise, the real benefit to be gained from Sarbox compliance is the way it accelerates your ability to use data in new and more interesting ways.
Instead of merely counting people as they come in, what if the electronic turnstiles were hooked into a centralized database? They'd be able to perform real-time trend analysis and monitor anomalies in traffic patterns so the park could better understand their customers. They could provide special benefits and incentives based on the projected visitor count. They could alert park management to an imbalance in the number of visitors passing through each gate so they'd know whether to alter parking lot availability to cut down on long lines. They could be tied to past data so park management would know whether they have enough employees in the park to handle the crowd.
In this scenario, technology plays a key role in eliminating a highly manual and painful parallel monitoring process. The monitoring occurs as part of a natural process to the business — that of getting paying customers into the park. And best of all, the requirement to count visitors has become a secondary benefit to the installation of a better business analysis tool.
Making Compliance an Automatic
Earlier we talked about employees changing a manual count to assure they meet their objectives. Making monitoring a part of the process solves that concern. If the turnstiles are hooked directly to the central database, there is no opportunity for the count to be changed before it is entered, either accidentally or through a conscious effort. The data is more reliable and, therefore, far more useful, both for Sarbox purposes and business analytics.
Closing Time Blues
Closing the books, whether it's for the month, the quarter or the year, is the mother of all processes designed to monitor processes. It's generally a traumatic time, filled with great pressure and angst. A hard stop for activities is agreed to, and then the organization starts working backward to verify what it believes has happened since the last close.
The trouble is that many organizations are still stuck on the idea that auditing is something that happens after the fact. Technology changes that equation, in effect creating a real-time audit as each activity happens. Because it provides full visibility and tracking, it allows you to immediately know everything about everything at any time you choose. You simply run the proper report and all the documentation is there.