Are you at risk of SOX noncompliance?
Sarbanes-Oxley compliance – mandating how publically traded US companies report their quarterly and annual results to their shareholders – is well-established and defined.
But as businesses adapt to new challenges, the systems and tools they use, such as Excel spreadsheets, can expose them to SOX compliance breaches.
Those can lead to fines, reputational damage, and, in extreme cases, having to re-state their earnings.
Effective SOX compliance in a dynamic environment
Data governance is at the core of SOX compliance, so CFOs and CEOs can report their results to their shareholders with confidence.
Companies subject to SOX invest heavily in their corporate IT systems and processes to ensure the data sources behind their results are accurate, clean, valid, reviewed, and approved.
The controls these systems use are ideal for SOX compliance processes, but can also hold back business processes that need to adapt at speed to new opportunities and situations. To overcome this, teams often use End User Computing (EUC) applications – typically spreadsheets – to achieve their objectives. Initially, this may be a temporary measure, but it can become permanent in the longer run.
The power and flexibility of these spreadsheets mean they are popular with end users, but they lack the controls or reference to the corporate SOX policy needed for effective SOX compliance. Flawed data, missing links, and calculation errors, for example, can be introduced into core SOX processes without warning. This can potentially compromise SOX processes, or add additional workload double-checking results.
These issues are worsened when uncontrolled spreadsheets feature in the SOX reporting consolidation process. This can expose a business to significant SOX compliance issues.
Solving the issue using automation
The automation of policy management and enforcement, alongside EUC management, delivers flexible and dynamic business processes while still assuring SOX compliance.
The biggest challenge in overseeing EUC assets is the huge volume of spreadsheets used in a business. The vast majority will be non-core, but finding and checking them all nearly impossible using manual methods. Automation can be used to scan and check tens of thousands of spreadsheets for SOX relevant terms quickly and efficiently, without disrupting the work of end users.
Once a spreadsheet estate is fully defined, they can be assessed for their significance to SOX, allowing the business to focus only on the most critical documents. A centralized inventory of EUC assets accelerates this process and allows users to ‘check-in’ their SOX-process spreadsheets as part of compliance policy.
Managers can also, via automated systems, monitor these critical SOX files. Changes, errors, and links to other applications, for example, can be identified and reviewed quickly and efficiently.
This management framework helps fully apply a firm’s SOX policy and measure compliance. A dedicated policy and compliance system can capture the core policy requirements for SOX, allowing people to easily check the policy requirements, and also validate and report their compliance with it.
This also allows spreadsheets to be retired efficiently; when a business is ready to integrate data and applications into the core SOX environment, it can happen easily, as the data, design, and interdependencies are fully understood and defined.
Solutions
Mitratech offers a set of solutions for SOX compliance allowing you comprehensively and cost-effectively meet its demands while easing the strain on your processes and personnel.
Policy Management
A policy management solution like Mitratech’s PolicyHub can save time and improve efficiency in creating, approving, and communicating policies, intelligent distribution, knowledge assessments, and reporting, while also giving an organization a defensible compliance program.
Compliance & Obligations Management
A compliance and obligations management solution, like Mitratech’s CMO offering, uses a simple, intuitive interface to let employees and auditors be proactive in incident and audit management, including regulatory obligations, controls, investigations, and non-conformance reporting. Easily report incidents, understand your obligations, and continuously improve your compliance performance.
EUC/Shadow IT Management
An automated tool like ClusterSeven lets you proactively discover, monitor, review, and audit changes made to End User Application spreadsheets and other “Shadow IT” data assets hidden across your enterprise. Gain a centralized view of enterprise-wide critical spreadsheet use, assess and prioritize critical spreadsheets, and provide transparency for management and auditors about your most important files.
