The latest data on Sarbanes-Oxley compliance—showing companies spent more time and money trying to comply in 2015—is beginning to suggest a new normal in the scrutiny around internal controls over financial reporting.

A clear majority of the 1,500 companies who participated in a recent poll by consulting firm Protiviti said the number of hours they devoted internally to Sarbanes-Oxley compliance in 2015 increased by more than 10 percent. Among large accelerated filers, it was 64 percent who agreed hours increased by 10 percent, while 70 percent of accelerated filers and 89 percent of nonaccelerated filers reported such an increase.

In terms of external audit fees, 50 percent of large accelerated filers said they saw an increase in fees in 2015, while 8 percent said they saw a reduction; the remaining 42 percent said they saw no change. It was 52 percent of accelerated filers, 41 percent of nonaccelerated filers, and 36 percent of emerging growth companies who said their fees rose. A little more than half of the nonaccelerated filers and emerging growth companies said they saw no change in external audit fees.

Brian Christensen, executive vice president at Protiviti, says he’s often asked by audit committee members when they can expect to see some leveling off in terms of the time and money it takes to comply with Sarbanes-Oxley. “I get that question a lot,” he says. “I think the efforts around Sarbanes-Oxley are not about attaining a destination, but achieving a level of excellence,” he says. Companies that have invested in internal controls are seeing a difference, and those that are focusing on automating and maintaining controls for the long-term are the ones best positioned to satisfy regulators and auditors, he says.

The survey suggests, in fact, that more than half of companies who participated have at least moderate plans to automate manual processes and controls in 2016. And there’s plenty of room for growth there, those companies reported. Only 9 percent of all public companies said they currently have automated more than 50 percent of their key controls. Half of companies said they have automated between 11 percent and 50 percent of their key controls, and roughly 30 percent have automated less than 10 percent of key controls.

In terms of where companies attribute the continued demands around Sarbanes-Oxley compliance, 44 percent of public respondents said they believe “very much so” that regulatory inspections on the audit firms performed by the Public Company Accounting Oversight Board are driving changes in compliance activities; 27 percent said the drive is “probably” due to PCAOB inspections.

Roughly two-thirds of survey respondents said they have seen a moderate or substantial increase in audit demands around risk assessments and scoping, selecting controls to test, roll-forward of controls testing from an interim date, and using the work of others. The response was even stronger around testing review of controls, testing system reports and other information produced by the entity, IT considerations, and evaluating identified control deficiencies.

Topics