As SOX costs persist, companies automate more controls

Whether because of SOX costs running amok or increased regulatory and competitive pressure in general, a growing number of companies are moving more methodically toward automating more of their internal controls over financial reporting.

The demands on finance and accounting only continue to grow in the post-Sarbanes-Oxley era, as regulators continue to demand more precision in financial reporting, especially with regard to internal controls. And an onslaught of new accounting rules are still in the wings, waiting to be adopted, especially massive new requirements around revenue recognition and leasing.

A recent survey by Protiviti found only a small percentage of public companies said the majority of their key controls for SOX compliance presently are automated, while up to one-third of companies have automated less than 10 percent of their key controls. Half of companies said they have at least moderate to significant plans to automate IT processes and controls in 2016. Only 12 percent said they have no plans to automate any controls.

“Regardless of the size of the organization, whether it is global or domestic, public or private, the only way to keep up with the demands is by looking at a lot of the processes we do and look toward technology and automation to help with that,” says Susan Parcells, senior director at software firm BlackLine. It’s not just the increased efficiency that is drawing companies in, she says, but it’s also about reducing risk. “Companies are saying if we keep doing these same activities manually we have exposure,” she says.

“We’re definitely seeing a trend in internal audit of trying to do more with automation, and I would connect the dots to say since SOX controls are transactional in nature they are easier to automate.”

Jim Pelletier, Vice President, Institute of Internal Auditors

The Institute of Internal Auditors is witnessing the increase as well, says Jim Pelletier, IIA vice president. “We’re definitely seeing a trend in internal audit of trying to do more with automation, and I would connect the dots to say since SOX controls are transactional in nature they are easier to automate,” he says, noting that while there is growth in automation occurring currently, there’s definitely room for plenty more.

Audit experts in the field say they see the migration toward automation as a way to cope with continued Sarbanes-Oxley-related regulatory demands and costs. “A big driver is management review controls and electronic audit evidence,” says Daniel Kim, vice president at technology firm SOXHUB. That’s been a flash point in audit inspections performed by the Public Company Accounting Oversight Board in recent years, where the board is instructing auditors to get more evidence that controls are operating at a level of precision that will address the risk of misstatement.

SOXFilerStatus1.png

Kim walked through a common report, the tracking of accounts receivable and how they are aging, to demonstrate the new level of audit demands. Before the PCAOB turned up its scrutiny, the typical audit involved checking the report for signoffs to assure the report had been produced and reviewed appropriately. It involved roughly four steps, he says.

“Now the AR manager has to do a lot more work to show he’s done that control properly,” says Kim. “He has to take screenshots of the report filter he’s running, and he has to do a test to make sure the system is spitting out the AR buckets accurately and completely.” The AR manager also has to review and test for thresholds, he says. “It doubles the amount of work that has to be done around the same control.”

Apply that same pattern to other similar management review controls, and it explains why “costs are going up exponentially,” says Kim, inspiring the move toward automation. “When a control is automated, it removes that manual layer and means less steps to that audit trail.” He sees a lot of companies moving account reconciliations to automated solutions for this very reason. “That’s probably one of the more pervasive areas.”

The best candidates for automation, says Jim DeLoach, managing director at Protiviti, are those that are highly manual, time consuming, and the most frequent cause of rework, mismatch, errors, and the like. “Wherever there’s an aspect of the financial reporting process where there’s a large amount of manual effort, that’s where the low-hanging fruit is,” he says.

SOXFilerStatus2.png

Emily Washington, senior vice president at software firm Infogix, says she sees companies trying to automate more in the earlier stages of the financial reporting process to improve the flow of information through the system. “You end up with good data lineage if it moves from A to Z within an accurate process,” she says.

Kari Sklenka-Gordon, a director and national leader at audit firm RSM, says she sees a “rejuvenation” of interest in automation spurred not only by audit risk but also by a desire to get more efficiency out of existing ERP systems. Especially where companies may have been following through on planned implementation during recessionary times, “the focus was just get the system in and get it working, but not with the best automation possible,” she says.

Now that the PCAOB has turned up the heat on internal controls, companies are intrigued by what more they can get out of their existing systems, especially in the middle market, says Sklenka-Gordon. Depending on configurations, sometimes that works, and sometimes it doesn’t. “Sometimes you find if you turn a setting on, it may break something else,” she says.

In pursuing more automation, companies also need to take care not to get carried away bolting together systems that may not interface with one another, says Sandra Richtermeyer, a COSO board member and recently appointed dean of the business school at University of Massachusetts Lowell. “I worry about companies having too many different products that they’re using,” she says. Patchwork systems can sometimes lead to less efficiency, not more.

The return on investment is a tricky calculation because it will vary so dramatically by company and by control, experts say. Automation is not cheap, but neither is the labor cost associated with ongoing manual execution of controls or the audit time associated with the external audit, not to mention the costs associated with remedying errors as they occur.

Even more difficult to factor in, says Sandy Herrygers, a partner and IT specialist leader at Deloitte, is the redeployment of human resources to higher-value tasks or analysis after freeing them from the manual processes. “When you replace some of that time with automation, people feel better about their work,” she says. “They’re not doing routine, rote control operations, so they can do more value-added activities from a business perspective.” That improves morale, she says.