Reducing time-on-compliance through practical automation

ARTICLE | June 05, 2023

Authored by RSM US LLP

Companies put a great deal of time and effort into Sarbanes-Oxley (SOX) compliance, in part because penalties for failure can be severe and the expectations for transparency in the market are so high. But while many companies do well enough meeting the requirements of SOX, few are truly good at it. Staff are stretched too thin and worked too hard. Inefficiencies abound, from poor infrastructure to overreliance on manual processes.

Technological tools, automation in particular, can turn that around.

It’s not enough to throw more people at the problem or work the ones you have harder. Particularly in this tight labor market, SOX compliance specialists are expensive and can be hard to find. Supporting them with the right automation tools can help.

However, even mature companies where leaders realize SOX processes need updating may balk at implementing robotic process automation (RPA) or employing an enterprise governance, risk management and compliance (GRC) solution. They labor under two major misconceptions:

1. The SOX team is too busy to make the shift.
2. There won’t be enough savings of time and money to justify the upfront cost and effort.

Often, companies look at how much they’re spending on auditing and see that as their cost of SOX compliance without considering the total effort and money they are expending in-house across the entire process. And too many are highly reliant on the performance of a handful of accounting and IT heroes who are performing manual control activities, which leaves the organization vulnerable when these employees burn out or move on.

But automation is not about replacing the people you have. In the world of SOX, more often than not, automation tactics are likely to aid in the day-to-day operations of those individuals rather than replace what they’re doing. Even if you add automation into a process, you still need people for validation functions and the like that allow you to be fully confident in your output.

To make it easier, don’t begin with a vision of wholly reinventing your processes. Take it in steps and look for the quick wins first.

Make existing systems work smarter

Your process begins with practical automation, which is often right under your nose. Rather than rush to adopt new systems, work to better understand your existing landscape. How can your technology architecture drive down the level of effort on manual controls or reduce the level of testing needed on those controls?

Look first to the enterprise systems that serve as your technological foundation. The automated or configurable controls already in place in your ERP are likely not optimized. If you were to adopt best-practice configurable controls, you might gain as much as 25% to 50% efficiency.

Bring RPA into the picture

Adopting RPA sounds scary and difficult, but it need not be either. RPA or monitoring-based controls can help you more easily identify higher-risk types of transactions and other low-hanging fruits that give you a clear return on your investment.

Even five to 10 very simple RPA techniques regularly monitoring data analytic controls could quickly give the accounting team the critical information they need without having to pull it up themselves, manipulate it, digest it, check it several times and then review it.

While not as economical as optimizing your existing controls, RPA still presents a relatively low cost to implement while seeing a notable return on investment.

Take the final step to eGRC

Typically, eGRC tools will be more helpful in the auditing process itself than in terms of enhancing the performance of your controls and other business processes. That’s fine, as streamlining audits will also benefit your bottom line.

Beyond direct audit applications, though, you could leverage eGRC to perform more automated testing techniques related to the audit process. Once again, look at where your people are spending their time and how technology can drive those manual efforts downward so your teams can do more than just keep up with SOX compliance.

Don’t go it alone

Part of the reluctance to adopt more automated processes is the fear of change or just the comfort in traditional or legacy methods. Partner with a provider that knows your industry, can understand your technological architecture, has a broad knowledge of available automation options and knows best practices that will take you farther, faster and more cost-effectively.

Particularly if you are a more mature company, you may have not just legacy systems but multiple ERP systems you took on through acquisitions that were never truly optimized. Sorting through all the systems, processes and opportunities alone only invites more wasted time and thus wasted money.

As with adopting technology itself, the upfront cost of engaging with a consulting and services partner will often be recovered in long-term gains to productivity, efficiency and accuracy.

By automating processes as much as you can, you can concentrate on what matters most—doing the higher-level thinking and analysis required to complete the SOX financial reporting and compliance reports on time.

---

This article was written by RSM US LLP and originally appeared on 2023-06-05.
2022 RSM US LLP. All rights reserved.
https://rsmus.com/insights/services/risk-fraud-cybersecurity/reducing-time-on-compliance-through-practical-automation.html

RSM US Alliance provides its members with access to resources of RSM US LLP. RSM US Alliance member firms are separate and independent businesses and legal entities that are responsible for their own acts and omissions, and each are separate and independent from RSM US LLP. RSM US LLP is the U.S. member firm of RSM International, a global network of independent audit, tax, and consulting firms. Members of RSM US Alliance have access to RSM International resources through RSM US LLP but are not member firms of RSM International. Visit rsmus.com/aboutus for more information regarding RSM US LLP and RSM International. The RSM(tm) brandmark is used under license by RSM US LLP. RSM US Alliance products and services are proprietary to RSM US LLP.