Transcription
2020State of theSOX/Internal ControlsMarket Survey
Table ofContents3Introduction4Executive Summary57Key findingsSurvey DemographicsMore C-suite respondents weigh in onSOX/IC Controls Market SurveyQuantifying Processes, Controls,and ComplianceSOX/IC management is dominated bybusiness process controls911Control FailuresControl deficiencies persistRole of TechnologyThe market’s use of advancedtechnology is low12Involvement of Internal Audit14Cost of Compliance16Priorities and Focus for theYear AheadSOX/IC compliance absorbs more thanhalf of internal audit’s timeMore than half experienced an increasein the cost of complianceImproving efficiency and creating valuefor the organization are high priorities18About Our Survey SponsorsAbout the SOX & Internal ControlsProfessionals GroupAbout Workiva
IntroductionDear Colleagues,What a difference a year makes. This is the fifth yearthat the SOX & Internal Controls Professionals Groupand Workiva have surveyed the market to assess howcompanies are managing their Sarbanes-Oxley (SOX)function. Our goal has always been to generate hard datafor SOX/IC professionals to use in benchmarking their riskand compliance programs.Survey responses indicate that practitioners will focus onreducing the complexity of internal controls processes inthe upcoming year. Optimizing control scoping, testing,and deploying automated control monitoring can contributeto improving the accuracy and quality of internal controls,which, in turn, could help to reduce the amount of timespent on manual testing.The 2020 SOX/Internal Controls Market Survey wasconducted as the COVID-19 pandemic began. While thecrisis upended the world, the biggest news in accountingcontrols and compliance was the recent collapse ofWirecard, a German fintech company.The technology that practitioners use also plays a rolein efficiency. More than half of the market uses a SOXspecific software technology tool to execute their SOXcompliance program. More than half also are consideringadopting continuous controls monitoring (CCM). Yet,for one-third of the market, spreadsheets and desktoppublishing tools anchor the SOX compliance program.The company’s five-year saga is a story of riskmanagement, compliance, and audit failure on aglobal scale.Both the COVID-19 crisis and the Wirecard storyunderscore the value of the SOX function and thecommitment of the professionals who keep theirorganizations informed and protected from financialreporting risk. This sentiment also is reflected in thesurvey results: two-thirds of respondents indicateorganizational leadership highly values the SOX andinternal controls program.Against this backdrop, monitoring and analyzing SOXmarket trends has never been more relevant.Improving efficiency in the SOX function was the strongesttheme throughout this year’s market survey—throughsurvey questions and write-in comments, it broke out asthe top priority for SOX/IC practitioners in 2020.That said, improving efficiency in any business processtakes the right combination of people, process design,and technology. Generally, over time, repeated processesbecome more efficient, but this hasn’t always been thecase for SOX and internal controls. For example, one-thirdof survey respondents report that they spend more thanhalf their time on SOX.The high-risk landscape created by COVID-19 andthe emphasis on efficiency makes this the right timeto consider the benefits of connected reporting andcompliance through a centralized, cloud-based platform.Automating repeatable, reliable processes that gatherdata reduces risk. Risk analysis is transformed bystronger, more trustworthy, and more accurate data.Teams can collaborate on documents, spreadsheets,and presentations to create high-quality reporting thatcreates clarity and value for the audit committee, board ofdirectors, and other stakeholders.Connected data improves accuracy, saves time, andcreates value for the entire organization. Seeing past theimmediacy of remote readiness and creating an agileand resilient internal controls and compliance functionnecessitates this.The SOX/IC professional who can meet these challengeswill create new opportunities for high-performancerisk management, which in turn, creates value acrossthe entire organization and enables accurate financialreporting, strong corporate governance, and adherencewith regulatory compliance.Sincerely,Hillary EckertVice President of Product MarketingWorkiva3 Introduction2020 State of the SOX/Internal Controls Market Survey
II.Executive SummaryFor the fifth consecutive year, the SOX & Internal Controls Professional Group and Workiva surveyed the market forinsights about the costs, execution, and challenges of complying with Sarbanes-Oxley (SOX).The survey was conducted online between March and April of 2020, just as the impact of the COVID-19 pandemic beganto unfold across the United States. Despite the timing and the circumstances, 428 SOX professionals responded to thesurvey, a decline from 475 respondents in 2019.The 2020 State of the SOX/IC Market Survey findings reflect the experience of SOX professionals over time. Surveycontributors represent various levels of process maturity and process complexity, and reflect a balanced perspective of thecurrent state of SOX and internal controls management.Key Findings from the 2020 State of the SOX/IC Market SurveyC-suite places a high value on SOX program.For the first time, the survey probed for perceptions about organizational leadership’s view of their company’s SOXprogram. Two-thirds of survey respondents believe that their organization’s leadership views the SOX program asof high or very high value. In an environment where risk is increasing due to process complexities and increasingorganizational scale, a congruent view of the SOX program by both corporate leadership and SOX practitionersensures that SOX has the institutional capital to thrive and be effective.Efficiency, cybersecurity, and regulatory compliance reign.The top three priorities for SOX professionals in the coming year are to improve the efficiency of the SOX program,increase the focus on cybersecurity and IT controls, and ensure compliance with SOX. The amount of time SOXprofessionals spend managing disconnected pieces of data is a driver for prioritizing the efficiency of the SOX function.Professionals are optimizing SOX to add value.SOX/IC professionals intend to focus on optimizing SOX control processes as a strategy to add value to theirprograms in the year ahead. The top three areas of value-add focus are: improving control selection and relatedtesting strategies, control rationalization to reassess and reduce the number of SOX controls, and control automation.Combined, these areas of focus can contribute to the goal of increasing efficiency in SOX execution, which in turnwould free up valuable staff time to work on analysis and value-add activities.No single technology stands out.On the whole, the adoption of advanced technology tools is a mixed bag. The survey reflects widespread use ofsoftware tools designed specifically to manage SOX and GRC. Many of these tools include advanced features like datavisualization and some automation. By contrast, one-third of the market continues to use spreadsheets and desktoptools to manage SOX. Despite the fact that SOX compliance has been required for more than 15 years, professionalsmay never unanimously adopt SOX compliance software—spreadsheets and desktop tools will be the default forsmaller public companies that need to meet SOX compliance.4 Executive Summary2020 State of the SOX/Internal Controls Market Survey
III.Survey DemographicsSurvey respondents are in roles that include planningand executing SOX and internal controls programs. Theyrepresent a diverse range of industries and company size,from 75 million to 5 billion in annual revenue.The views of senior management are represented byC-suite- and vice president-level contributors, who accountfor 17% of this year’s survey respondents compared to14% in 2019.The survey also documents the prevalence of SOXcompliance in the private sector: one-quarter ofsurvey respondents identify themselves as non-publiccompanies, and 22% of these identify as privatecompanies. There are two key reasons for privatecompanies that are non-SEC registrants and thus notrequired to comply with SOX regulations to have SOXcompliance programs: (i) they issue publicly traded debt,which requires the issuer to have controls over financialreporting; (ii) they are pre-IPO or have aspirations to gopublic and hence have implemented SOX programs inanticipation of a public listing.Private capital investors, bank lenders, and nonfinancialregulators take into consideration private companies’risk management practices as part of their duediligence process. For the private company, SOXrisk management—particularly related to technology,cybersecurity, and privacy compliance—offers someassurance to these stakeholders.How would you describe your role?C-suite7%(CAE, CFO, CAO, CCO, etc.)Vice her5%0%5% 10% 15% 20% 25% 30% 35% 40%The number of respondents from organizations thatgenerated less than 75 million in revenue increased from16% to 44% in 2020. The number of respondents whowork in organizations that reported more than 5 billion inannual revenue declined from 26% to 23%.5 Survey DemographicsWhat best describes your type of nt75%What is your organization’s last fiscalyear revenue? 75M23% 75M- 700M44% 701M- 2B10% 2.1B- 5B14% 5B9%In what industry does your company best fit?Finance, insuranceManufacturingOtherHealth careUtilitiesProfessionals, scientific, technicalMining, quarrying,oil, gasRetail tradeInformationTransportation, warehousingConstructionReal estate, rental, leasingArts, entertainment, recreationEducational servicesAgriculture, forestry, fishing, huntingWaste managementManagement of companiesWholesale tradePublic %0%0%0%5%10%15%20%25%30%2020 State of the SOX/Internal Controls Market Survey
Select the category that best fits yourexternal auditor.14%5%Big FourLocalRegionalThe two most represented industries are finance andinsurance and manufacturing, which is unchanged fromthe 2019 survey.The Big Four audit firms continue to dominate the field ofexternal auditors used by the companies in which surveyrespondents are employed. More than 80% of respondentsreport using the Big Four, while 14% use regional auditorsand 5% use local auditors.81%6 Survey Demographics2020 State of the SOX/Internal Controls Market Survey
IV.Quantifying Processes, Controls, and ComplianceS O X / I C M A N A G E M E N T I S D O M I N AT E D B Y B U S I N E S S P R O C E S S C O N T R O L SIn 2019, our survey focused on the control category,and we continued that same focus in 2020. We askedrespondents to break down their controls into entity-levelcontrols, information technology general controls, andbusiness process controls. A dominant portion of controlswere business process controls.Of your key controls, how many fit into theentity-level category?2%4%4%1-256%26-506%51-7546%Of your key controls, how many fit into thebusiness process category?2%101-5001%32%1-1005%7% 500Not sure101-25033%251-50017%501-1,000Of your key controls, how many fit into theITGC category?1,001-2,000 2,00035%3%4%Almost half of respondents report that their organizationsmanage fewer than 250 key controls. 17% manage fewerthan 100 controls compared with 22% in 2019. 31% reportmanaging between 101 and 250 key controls, an increasefrom 26% in 2019. Only 4% of respondents report thattheir organizations manage more than 2,000 controls, aslight decrease from 5% in 2019.What is the total number of key/testedcontrols annually?1-10023%4% 2,0004%Not sure0%Not sure9%2-1040%9%15%51-10010%9% 10015%20%25%7 Quantifying Processes, Controls, and Compliance251-500 1-50051-10012%How many total locations does yourorganization have?17%101-2501-507%Not sure501-1,00076-10030%35%18%0%5% 10% 15% 20% 25% 30% 35% 40%2020 State of the SOX/Internal Controls Market Survey
Number of internal controls vs. numberof locationsOverall, internal testing and validation teams grewcompared to last year’s survey. The number of surveyrespondents with five or fewer people on their SOX testingand validation team declined to 44% from 50% in lastyear’s survey results. Respondents who reported teamsbetween 5 and 10 people increased to 30% from 27% lastyear, teams of 11 to 20 people stayed the same at 12%,and teams between 21 and 50 people increased to 8%from 7% last year. Teams of 50 or more increased to 6%from 4% in 2019.1-100101-250251-500501-1,0001,001-2,000How many process/control owners are inyour organization? 2,0000%20%140%2-1060%80%100%13%23%21-5011-20 1010-25 10051-100There is a correlation between the number of controls and thesize of the company’s revenue. Half of the respondents whoreported 1–100 internal controls are from organizations withless than 700 million in revenue. Conversely, almost 70% ofthe respondents who reported more than 2,000 controls comefrom organizations with more than 5 billion in revenue.26%13%26-5051-100 10025%What is your SOX compliance model?Number of internal controls vs. 0Outsourced501-1,00055%1,001-2,000N/A - Not required tobe SOX compliant 2,0000% 75M20%40% 75M- 700 2.1B- 5B60%80%100% 701M- 2B 5BHow many people are on your SOX testing andvalidation team?8%6%The in-house compliance model increased to 55% from50% in 2019. 31% reported a co-sourcing model, upfrom 29% in 2019. 6% of the respondents outsourceSOX compliance, up from 5% in 2019. Combined with anincrease in the size of testing teams, the results suggestthat companies are investing in in-house staff. 55-1012%44%11-2021-5030% 508 Quantifying Processes, Controls, and Compliance2020 State of the SOX/Internal Controls Market Survey
V.Control FailuresCONTROL DEFICIENCIES PERSISTIn the past fiscal year, did you experience anycontrol issues that led to deficiencies, significantdeficiencies, or material weaknesses?How many significant deficiencieswere identified?5%035%Yes36%1-559%No5 65%In 2020, 65% of respondents reported control issuescompared to 61% in both 2019 and 2018.How many deficiencies were identified?The number of survey respondents who report zerosignificant deficiencies is 59%, a slight increase from53% reported in 2019. 36% reported between 1 and5 significant deficiencies, and 5% reported 5 or moresignificant deficiencies.How many material weaknesses were identified?10%3%1-1017%46%27%11-2514%26-50051 1-55 83%Survey respondents reported sharp increases in thenumber of deficiencies identified between 1 and 25. 46%of survey respondents report identifying between 1 and 10control deficiencies, an increase from 34% last year, and27% report between 11 and 25 control deficiencies, anincrease from 16% last year.9 Quantifying Processes, Controls, and ComplianceThe number of survey respondents who report zeromaterial weaknesses is 83%, an increase from 78%reported in last year’s survey. 14% of respondents reportbetween 1 and 5 material weaknesses, a decreasefrom 18% reported in last year’s survey. 3% of surveyrespondents report identifying more than 5 materialweaknesses, a slight decrease from the 4% who reportedmore than 5 material weaknesses in last year’s survey.2020 State of the SOX/Internal Controls Market Survey
What was the impact of the deficiencies as anabsolute percentage of revenue? 1%75%2-5%6-10%19%3%11-25%3% 75%.44%Three quarters of survey respondents report that theimpact of control deficiencies was less than 1% ofcompany revenue. Almost 20% of respondents reportedan impact between 2% and 5% of revenue. At the oppositeend of the range, fewer than 9 respondents reportedcontrol deficiencies whose impact was greater than 75% ofcompany revenue.Similar to previous surveys, respondents identify the sameroot cause leading to control failures: the control was notproperly performed, enforced, or monitored; human error;and poor control design.0% 10% 20% 30% 40% 50% 60% 70% 80%What were some of the causes for controlfailures?Poor control designControl not properly performed,enforced, or monitoredControl was overriddenor circumventedHuman errorUnforeseen circumstanceOther, please specify0%20%202040%60%80%100%201910 Quantifying Processes, Controls, and Compliance2020 State of the SOX/Internal Controls Market Survey
VI.Role of TechnologyT H E M A R K E T ’ S U S E O F A D VA N C E D T E C H N O L O G I E S I S L O WWhile the majority of the SOX market uses specialty software to execute and document SOX compliance testing, adoptionof analytical tools that help SOX professionals improve their efficiency in the identification of test samples or anomalieswithin the control processes is less prevalent.SOX professionals registered a strong interest in using continuous controls monitoring (CCM) in their SOX programs.CCM is typically the initial advent in automation of control testing, and it complements SOX compliance programs byreducing manual controls testing, which in turn, improves overall program efficiency by deploying SOX resources toanalyses of findings.What is the primary technology tool that you utilize to support your SOX/IC process?GRC software solution20%SOX-specific software tool39%Desktop tools (e.g., Microsoft Excel,Word, and PowerPoint) 31%Data analytics tool2%Homegrown 0%Testing management solution software, either GRC broadly or SOX compliance, specifically, is used by close to 60% ofthe respondents. Almost one-third of the respondents use desktop tools to complete SOX compliance. Spreadsheets anddesktop tools are largely the default for smaller public companies that need to meet SOX compliance.Do you currently use or have you considered using continuous control monitoring (CCM)within your SOX program?Yes, we have implemented automation12%No, but we are considering it56%No, I don’t know what CCM is25%Other7%0%10%20%30%40%50%60%More than half of this year’s survey respondents report they are considering adopting CCM, which is a slight increasefrom 53% reported last year. The number of CCM implementations reported by survey respondents remains unchangedfrom last year.11 Role of Technology2020 State of the SOX/Internal Controls Market Survey
VII.Involvement of Internal AuditSOX/IC COMPLIANCE ABSORBS MORE THAN HALF OF INTERNAL AUDIT’S TIMEWhat department is in charge of managing SOX/IC compliance in your organization?36%Dedicated SOX/IC compliance team12%Financial reportingInternal audit45%Legal/compliance2%Other5%0%10%45% of respondents identify internal audit as the ownerof SOX compliance, which is a slight decline from 46%last year. Additionally, 36% of survey respondentsreport that financial reporting teams own compliance,which is an increase from 34% last year. This reflects alonger term trend of separating financial reporting fromcompliance management.What is your internal audit model?7%6%21%Co-sourcedIn-houseOutsourced66%12 Involvement of Internal AuditN/A - No formalinternal audit function20%30%40%50%Survey respondents who report an in-house internal auditmodel is 66%, unchanged from last year. Likewise, thoserespondents who report a co-sourced model is unchangedat 21%. 7% of survey respondents report that theyoutsource internal audit, down from 8% in 2019, and 6% ofsurvey respondents have no formal internal audit functioncompared with 5% last year.Internal audit (IA) continues to maintain a high level ofinvolvement in the SOX/IC function across the board.77% of respondents report that IA is involved in testingand roll forward processes, which is the same as in 2019.68% are involved in walkthroughs, issue tracking andreporting, down from 72% last year. 64% are involved inrisk assessment, up from 63% in 2019. Each of these areprimary procedures for measuring how well a companymanages its internal controls.2020 State of the SOX/Internal Controls Market Survey
How is internal audit involved with your SOX/IC program?Risk ntrol documentation53%Testing and roll forward77%Issue tracking and reporting68%Reporting56%Training33%Project management33%Not involved10%0%10%20%30%40%50%60%70%80%31% of IA teams with SOX responsibility were spending more than 50% of their time on SOX, no change from 2019.Coupled with the data that 44% of these IA teams are only managing 1 to 10 operational audits in addition to SOXindicates that the burden of SOX on IA teams is impinging on assurance reviews.44% of respondents perform between 1 and 10 audits, compared with 39% in 2019. 25% of respondents perform between11 and 20 audits compared with 29% last year. 20% report performing between 21 and 50 audits compared with 16% lastyear, and 9% report more than 50 audits compared with 11% last year.What percent of time does internal audit spendon SOX?3%014% 10%In addition to SOX testing, how manyoperational audits does your organizationperform each year?10-25%1-1025%44%11-2026-50%30% 50%0%21-5031%5%10%15%13 Involvement of Internal Audit20%25%30%25%35%20% 509%0%10%20%30%40%50%2020 State of the SOX/Internal Controls Market Survey
VIII.Cost of ComplianceALMOST HALF EXPERIENCED AN INCREASE IN THE COST OF COMPLIANCEFor your previous fiscal year, what change (if any) did you experience in your overallSOX/IC assessment costs?11%Increased significantly10%33%Increased slightly39%44%Remained the same39%11%Decreased slightly8%20202%Decreased significantly20195%0%10%20%30%40%50%A total of 44% of survey respondents report an increase in SOX/IC costs compared with 13% who report a decrease incosts. 44% of survey respondents report SOX/IC compliance costs remained the same.33% of survey respondents report a slight increase in SOX/IC compliance costs compared to 39% last year, while 11%report a significant increase compared to 10% last year.11% of survey respondents report a slight decrease in SOX/IC compliance costs compared to 8% last year, while 2%report a significant decrease in compared to 5% last year.14 Involvement of Internal Audit2020 State of the SOX/Internal Controls Market Survey
44% of survey respondents report spending less than 1million on SOX compliance compared with 52% in 2019.18% spend less than 250,000, a decline from 24% in lastyear’s survey. 27% of survey respondents report spendingbetween 1 million and 3 million on SOX compliance, anincrease from 24% compared with last year.More than half of survey respondents report an increasein external audit fees, a slight increase from 50% in 2019.9% report a decrease, unchanged from 2019, and 40%report no change in external audit fees, down from 41%compared with last year.For your previous fiscal year, what change(if any) did you experience in your externalaudit fees?9%40%51%15 Involvement of Internal AuditNo change in externalaudit feesWhat is the company’s annual spend for SOX/ICcompliance, including any consulting andexternal audit fees?18% 250K 250K- 500K16%13% 501K- 1M12% 1.01M- 1.5M7%9%9% 1.51M- 3M9%9% 3M8%28%Don’t know0%24%13%24%5%10%202015%20%25%30%2019Increase in externalaudit feesDecrease in externalaudit fees2020 State of the SOX/Internal Controls Market Survey
IX.Priorities and Focus for the Year AheadI M P R O V I N G E F F I C I E N C Y A N D C R E AT I N G VA L U E F O R T H EO R G A N I Z AT I O N A R E H I G H P R I O R I T I E SWhat are your organization’s top priorities for this year?Improve efficiency of the SOX function42%Increasing focus on cybersecurity and IT controls41%Ensure compliance with SOX and other regulators36%Control automation28%Improved transparency into risk,issues/remediation and compliance26%Replace legacy technology with new systems24%Build on talent and skills23%Risk of data integrity and transparency15%Reduce/enhance organization's riskmanagement capabilitiesIdentify control requirements for new accounting policies(revenue recognition, lease accounting, and tax)Strengthen organizational relationships (audit committee,board, external auditors, management, etc.)14%13%12%Critical audit matters (CAMs)8%0%10%20%30%40%50%The top three priorities for SOX professionals in the coming year are improving the efficiency of the SOX program,increasing the focus on cybersecurity and IT controls, and ensuring compliance with SOX. The amount of time SOXprofessionals spend managing disconnected pieces of data is a driver for prioritizing the efficiency of the SOX function.Which of the following areas are you focusing on to add value to your SOX program?Control optimization: improving controlselection and related testing strategiesControl rationalization to reassess andpotentially reduce key controls42%60%53%Control automation44%Modifying testing approach based onexternal auditor’s reliance model27%Minimizing cost to testing controls33%Ensuring maximum relianceby external auditorChanging business processesto maximize business value31%25%Other5%0%16 Priorities and Focus for the Year Ahead10%20%30%40%50%60%2020 State of the SOX/Internal Controls Market Survey
The top three areas of value-add focus are improving control selection and related testing strategies, controlrationalization to reassess and reduce the number of SOX controls, and control automation. Combined, these areas offocus can contribute to the goal of increasing efficiency in SOX execution, which in turn, would free up valuable staff timeto work on analysis and value-add activities.Two-thirds of survey respondents believe that their organization’s leadership views the SOX program as of high or veryhigh value. In an environment where risk is increasing due to process complexities and increasing organizational scale,a congruent view of the SOX program by both corporate leadership and SOX practitioners ensures that SOX has theinstitutional capital to thrive and be effective.How is the SOX program in your organization viewed by leadership?20%Very high valueHigh value46%Neither high nor low value27%Low value4%Very low value3%0%17 Priorities and Focus for the Year Ahead10%20%30%40%50%2020 State of the SOX/Internal Controls Market Survey
X.About Our Survey SponsorsABOUT THE SOX & INTERNALCONTROLS PROFESSIONALS GROUPMembers of the SOX & Internal Controls ProfessionalsGroup are actively involved with SOX, internal controls,and internal audit processes for public and privatecompanies, including documenting, evaluating andtesting internal controls, and processes.The SOX Pro Group fosters networking and industrythought leadership and provides unique opportunities formembers to share best practices.There is no cost to join, and membership provides accessto a broad network of other like-minded professionals whilehelping them increase their value and influence acrosstheir organizations.Visit soxprofessionalsgroup.org for more information.J109555 20200825The information contained herein is proprietary to Workiva and cannot be copied, published,or distributed without express prior written consent. Copyright 2020 Workiva Inc. Workiva isa registered trademark of Workiva Inc. All rights reserved. Word, Excel, and PowerPoint areregistered trademarks of Microsoft Corporation in the United States and/or other countries.A B O U T W O R K I VAWorkiva is the provider of the world’s leading connectedreporting and compliance platform. Workiva is used bythousands of enterprises across 180 countries, including75 percent of the 500 largest U.S. companies by totalrevenue, and by government agencies. Our customershave linked over five billion data elements to build trustin their data, reduce risk, and save time. For moreinformation about Workiva (NYSE:WK), please visitworkiva.com.
ensures that SOX has the institutional capital to thrive and be effective. Efficiency, cybersecurity, and regulatory compliance reign. The top three priorities for SOX professionals in the coming year are to improve the efficiency of the SOX program, increase the focus on cybersecurity and IT controls, and ensure compliance with SOX.
