Companies trying to comply with the Sarbanes-Oxley Act of 2002 are finding that one of the toughest—and yet most essential—areas for establishing controls over internal processes and procedures isn’t even required under the law: spreadsheets.

Companies trying to comply with the Sarbanes-Oxley Act of 2002 are finding that one of the toughest—and yet most essential—areas for establishing controls over internal processes and procedures isn’t even required under the law: spreadsheets.