ACL's Sarbanes-Oxley survey of internal audit executives uncovers problems in Year Two plans and processes
Vancouver, BC — June 28, 2005 — More than 95 percent of companies in a recent survey report that a "reduction of staff time and associated costs to test internal controls" is key to maintaining effective compliance with Sarbanes-Oxley requirements, according to a survey conducted by ACL Services and the Center for Continuous Auditing (CCA).
The poll of 247 senior audit professionals at corporations with more than $1 billion in annual revenues looked at the serious challenges organizations face in making their SOX compliance efforts sustainable.
The burden of compliance hit companies hard in Year One, but this survey confirms what many in the market have been saying, that Year Two will not provide the efficiencies organizations had hoped for. The ACL/CCA survey reports that only 40 percent of these organizations already have automated, or plan to automate, the testing of their controls this year, leaving nearly 60 percent of the companies to continue the struggle to find the skilled resources necessary to test the myriad of internal controls present in any large organization.
Ongoing Testing "Most Challenging"
Section 404 of the Sarbanes-Oxley Act, which requires corporate management teams to assess and test the effectiveness of internal controls on an ongoing basis, has proven to be the most challenging section of the legislation to comply with for most companies. It is time-consuming and difficult because it requires expert knowledge of internal controls objectives and represents technical challenges, since much of the information that must be tested resides on different IT systems spanning multiple business processes across the enterprise.
An overwhelming 92 percent of respondents identified the importance of enabling timely and effective management insight into controls deficiencies, giving further credence to the fact that sustaining SOX 404 compliance is a top-of-mind concern for audit and financial management. In addition, more than 80 percent of the audit executives cited the need for faster, more effective identification and correction of inappropriate transactions, and they deemed increased investments in technology solutions designed to continuously monitor controls to be important for their organizations.
"The results of this survey mirror much of what we heard last year," said Harald Will, president and CEO of ACL Services, a provider of business assurance analytics technology for audit and controls professionals. "Many companies still maintain a short-term mindset when addressing the ongoing requirements set forth in Sarbanes-Oxley, despite recognition of the benefits of ongoing and continuous monitoring of transactions for the purposes of assuring internal controls."
Need for Continuous Processes
Will added that while internal auditors are overwhelmingly in favor of adopting the technology and best practices of continuous monitoring and auditing, organizations frequently don't seem ready or willing to back them up.
"Continuous monitoring of controls is a management function and part of the organization's control structure in accordance with [Committee of Sponsoring Organizations (COSO)] best practices," said J. Donald Warren Jr., director of the CCA. "Auditors, on the other hand, use continuous auditing processes to test transactions and identify anomalies and to test the continuous monitoring processes of management. The combination of these continuous processes provides management with timely information to take corrective action when a control deficiency is identified, as well as providing assurance to management on the effectiveness of the company's internal control environment."
David M. Walker, comptroller general of the United States and chair of the CCA Advisory Board is a longtime advocate of continuous auditing. "I am pleased to see that the audit professionals surveyed strongly endorsed the value of continuous monitoring and auditing to support ongoing Sarbanes-Oxley compliance," Walker said. "Until there is mainstream adoption of these best practices, companies will continue to experience challenges managing their compliance processes. Technologies that automate and monitor controls — on an ongoing basis — will be critical for achieving true success in the future."
Additional Articles of Interest
— For more information on Sarbanes-Oxley, read Parts 1 and 2 of the recent SDCExec.com series on Contract Management: Five Myths of Contract Management, and Contract Management: Improving Corporate Governance.
— Other recent SDCExec.com articles on Sarbanes-Oxley:
Vancouver, BC — June 28, 2005 — More than 95 percent of companies in a recent survey report that a "reduction of staff time and associated costs to test internal controls" is key to maintaining effective compliance with Sarbanes-Oxley requirements, according to a survey conducted by ACL Services and the Center for Continuous Auditing (CCA).
The poll of 247 senior audit professionals at corporations with more than $1 billion in annual revenues looked at the serious challenges organizations face in making their SOX compliance efforts sustainable.
The burden of compliance hit companies hard in Year One, but this survey confirms what many in the market have been saying, that Year Two will not provide the efficiencies organizations had hoped for. The ACL/CCA survey reports that only 40 percent of these organizations already have automated, or plan to automate, the testing of their controls this year, leaving nearly 60 percent of the companies to continue the struggle to find the skilled resources necessary to test the myriad of internal controls present in any large organization.
Ongoing Testing "Most Challenging"
Section 404 of the Sarbanes-Oxley Act, which requires corporate management teams to assess and test the effectiveness of internal controls on an ongoing basis, has proven to be the most challenging section of the legislation to comply with for most companies. It is time-consuming and difficult because it requires expert knowledge of internal controls objectives and represents technical challenges, since much of the information that must be tested resides on different IT systems spanning multiple business processes across the enterprise.
An overwhelming 92 percent of respondents identified the importance of enabling timely and effective management insight into controls deficiencies, giving further credence to the fact that sustaining SOX 404 compliance is a top-of-mind concern for audit and financial management. In addition, more than 80 percent of the audit executives cited the need for faster, more effective identification and correction of inappropriate transactions, and they deemed increased investments in technology solutions designed to continuously monitor controls to be important for their organizations.
"The results of this survey mirror much of what we heard last year," said Harald Will, president and CEO of ACL Services, a provider of business assurance analytics technology for audit and controls professionals. "Many companies still maintain a short-term mindset when addressing the ongoing requirements set forth in Sarbanes-Oxley, despite recognition of the benefits of ongoing and continuous monitoring of transactions for the purposes of assuring internal controls."
Need for Continuous Processes
Will added that while internal auditors are overwhelmingly in favor of adopting the technology and best practices of continuous monitoring and auditing, organizations frequently don't seem ready or willing to back them up.
"Continuous monitoring of controls is a management function and part of the organization's control structure in accordance with [Committee of Sponsoring Organizations (COSO)] best practices," said J. Donald Warren Jr., director of the CCA. "Auditors, on the other hand, use continuous auditing processes to test transactions and identify anomalies and to test the continuous monitoring processes of management. The combination of these continuous processes provides management with timely information to take corrective action when a control deficiency is identified, as well as providing assurance to management on the effectiveness of the company's internal control environment."
David M. Walker, comptroller general of the United States and chair of the CCA Advisory Board is a longtime advocate of continuous auditing. "I am pleased to see that the audit professionals surveyed strongly endorsed the value of continuous monitoring and auditing to support ongoing Sarbanes-Oxley compliance," Walker said. "Until there is mainstream adoption of these best practices, companies will continue to experience challenges managing their compliance processes. Technologies that automate and monitor controls — on an ongoing basis — will be critical for achieving true success in the future."
Additional Articles of Interest
— For more information on Sarbanes-Oxley, read Parts 1 and 2 of the recent SDCExec.com series on Contract Management: Five Myths of Contract Management, and Contract Management: Improving Corporate Governance.
— Other recent SDCExec.com articles on Sarbanes-Oxley:
- Synchronize to Survive
- Sarbanes-Oxley: The Next Y2K?
- Survey Reveals New Findings on Sarbanes-Oxley Compliance
- Most Companies Working on Sarbanes-Oxley
- Survey: Most Companies Have Not Budgeted for Sarbanes-Oxley Compliance
- More articles about Sarbanes-Oxley.
