GRC Journal - (Page 20) THE 2006 GOVERNANCE, RISk & COMPLIANCE INDEX Governance, Risk & Compliance fact that 50 percent of respondents do not believe that their management team understands what ERM is or the value it offers. Twelve percent of companies have completely integrated ERM with their SOX program, whereas 44 percent have somewhat integrated it with SOX, and the final 44 percent do not have any ERM-SOX integration at all. GRC Software: GRC software offers companies a repository and management system to create better control of data, clearer management controls, and less time spent managing the data and creating management reports – which all translates into cost savings across the organization. Ownership issues No clear SOX organization Many business changes (e.g. Acquisitions) Project versus process mind-set Other FIGURE 5: What is the biggest challenge to your company in sustaining SOX efforts? 39% 6% 17% 30% 8% 0% 10% 20% 30% 40% 50% About half of the companies surveyed claimed to be using a SOX-specific technology to manage their efforts. Seventy-eight percent of these software packages were purchased in the company’s first compliance year for the explicit purpose of SOX compliance. As companies have discovered, while their software may have been useful for SOX, it falls short when the company tries to broaden its use to support other risk management or compliance requirements. As a result, 50 percent of respondents also claim that they would not pick the same tool again if they had the choice. They cited four specific criteria that they would use in the purchase of software. (See Fig. 4) In particular, software flexibility, reporting, and user-friendliness were of paramount concern. Flexibility means the software should be able to simultaneously support and manage multiple risk management and compliance frameworks. Users should be able to design frameworks that accurately map their company’s organizational structure and business processes. When capturing information, the tool should allow users to configure specific questions and assessments by the items in their frameworks (i.e. objective, process, sub-process, risk, control, tests). Additionally, flexibility should enable you to manage permissions, actions, issues, etc. for each user. Finally, the software should provide ease of access across multiple geographies, which is easily achieved through an internetbased tool. This also enables centralized administration of the application which avoids the need to install it on every user’s computer. CONCLUSIONS: To conclude, let’s review what companies deemed to be their biggest challenges in sustaining their SOX efforts (See Fig. 5). The two dominant challenges cited were a lack of clarity or accountability in SOX program ownership, and an attitude that SOX was a project rather than an ongoing program that required planning to properly sustain itself. Another aspect that continues to add complexity to these programs is the fluid nature of business through acquisitions, restructuring, and the adoption of new technologies – all of which can immediately influence internal financial reporting processes. Clearly there is more work to be done. Documentation and evaluation of internal controls are the foundation to help companies achieve maximum benefit from their investment, but adopting new compliance processes and technologies always takes time. Richard Wilson is the EVP of Resolver Inc., a risk management and compliance software company. Resolver’s software and services help companies manage Sarbanes-Oxley and Bill 198 Compliance, ERM, and Corporate Governance. Richard manages Resolver’s client services team whose solutions include risk and control self-assessment, fraud risk assessment, compliance management, and regulatory reporting. For information: email richard.wilson@resolver.ca or visit www.resolver.ca 54 BTQ Business Trends Quarterly Q1 2007 | www.btquarterly.com http://www.resolver.ca http://www.btquarterly.com
For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.