Companies continue to invest more time and money in their Sarbanes-Oxley (SOX) compliance activities, driven by forces that include organizations that are changing and growing and increased regulatory scrutiny, according to Protiviti’s 2016 Sarbanes-Oxley Compliance Survey.
With this continued investment, however, companies are reaping notable benefits from their compliance efforts through improved internal control structures and business processes, which in turn have positive ripple effects throughout the organization as a whole.
The survey report, Understanding the Costs and Benefits of SOX Compliance, which was released today, culled data from more than 1,500 respondents who participated in the survey during the first quarter of 2016.
The extensive report provides a detailed look into the wide array of SOX costs and hours across different sizes and types of companies, and explores how factors such as industry, category (public vs. private), maturity and size of the organization, along with its SOX compliance progress and SOX filing status, affect average annual SOX compliance expenditures.
“With the amount of time and money invested in Sarbanes-Oxley compliance on the upswing, we’re pleased to see the growing investment is paying off, with more companies reporting better and more streamlined internal control structures and business processes,” said Brian Christensen, executive vice president with Protiviti and leader of the firm's global Internal Audit and Financial Advisory practice.
“Companies understandably would prefer to spend less time and money on their compliance efforts, but the Sarbanes-Oxley Act was created to improve the quality and reliability of internal control over financial reporting structures in organizations. We’re excited to see that this intention is already actualized in many of the companies surveyed.”
Not surprisingly, the largest companies (annual revenues of $20 billion or more) spend the most on their internal SOX compliance costs (which, for the purposes of this study, include fees for third-party co-sourced or outsourced providers, but exclude external auditor fees). Below that level, however, compliance costs are relatively consistent until annual revenues drop below $500 million.
Similarly, companies responding to the Protiviti survey said the number of hours they devoted to SOX compliance increased in fiscal 2015.
Many respondents reported that their SOX compliance efforts have brought about positive effects to their organization. Among the companies with mature SOX compliance processes, two out of three believe there have been significant or moderate improvements to the internal controls associated with their financial reporting structures.
Perhaps most important, however, is that organizations are leveraging their SOX compliance efforts to drive continuous improvement of their business processes, illustrating the lasting beneficial implications of this effort.
“More and more are realizing that if they approach their compliance processes in the right way, employing proven best practices such as automating more of their key controls, there will be positive ripple effects throughout their organizations,” said Christensen.