SOX compliance pain points for newly public companies

Clear and comprehensive SOX compliance communication from the top is imperative. For many, public-company internal control over financial reporting (ICFR) and SOX compliance requirements can be perceived simply as a burden. Company leaders have both the responsibility and the opportunity to encourage a mindset shift that leads to a better understanding of how SOX compliance can help manage (and potentially reduce) risk. That includes driving an effective SOX compliance program that’s about more than mere compliance.

The lack of proper resources is often a contributing factor to other issues such as improper segregation of duties in the design and operation of internal controls and not being able to properly execute an effective monitoring program. As a result, the operational inefficiencies and necessary remediation efforts that companies face can ultimately lead to an increase in overall costs. Company leaders should revisit their resource pool and address shortages by hiring in-house and/or engaging an outside service provider as needed. Many companies find that outside providers are most effective when they work with designated internal project managers.

A model SOX program starts with a robust, multi-stakeholder risk assessment that provides opportunities to identify account balances and risks as well as needed improvements to the internal control program. Conducting a robust risk assessment is imperative for effective SOX compliance and should incorporate changes in accounting processes, information technology (IT), organizational structure, or financial performance.

Several factors can indicate that the current state of your company’s SOX compliance program may be at risk of unsustainability. One way to address unsustainability is to conduct SOX modernization analysis, especially if the current system of internal control remains closely aligned with the structure before going public. SOX modernization provides long-term benefits that may help align with workforce transformation and support a company through change.

A public company most likely needs reliable information technology (IT) controls to support internal control over financial reporting. When there are issues associated with general information technology controls (GITCs), they can lead to unaddressed risks associated with information technology (RAIT). Since most business processes rely on data obtained from IT systems, IT issues may have an immense impact on your system of internal control.