The cost of SOX compliance is still high, with a significant number of large companies spending $2 million or more per year, a rise in external audit fees and more time spent on compliance.

A decade ago, you could hardly pick up a financial publication without the words 'Sarbanes-Oxley' jumping off the page from one of the many articles written at the time discussing the difficulties and cost of compliance. The Act was introduced in the US in 2002 following accounting scandals such as those at Enron, Tyco and WorldCom.

Compliance burden increases

Some 14 years later, SOX compliance no longer hits the headlines but it's still causing headaches for those in the financial and IT departments responsible for ensuring their companies meet requirements. Research by Protiviti, which polled 1,500 executives in Q1 2016, shows that the cost of compliance varies but a significant number of large companies are spending $2 million or more per year on Sarbanes-Oxley compliance. And many organisations are spending more time on SOX compliance in 2016 than in previous years.

The cost and resources needed for compliance vary according to several factors, including:

• whether the company is public or private;
• industry sector (a organisation in the 'healthcare payer' sector spends on average almost three times as much on internal SOX compliance than a company in the media industry); and
• the company's SOX filer status (those with 'accelerated filer' status spend significantly less per year than companies with 'emerging growth' status).

The graph below shows the average annual SOX compliance costs (internal) by company size:

 

Protiviti explains the increased SOX compliance burden on:

• ongoing implementation of the new COSO internal control framework;
• evolving external auditor requirements for Section 404(b) compliance; and
• efforts among organizations that currently comply only with Section 404(a) to prepare for the level of rigour required to comply with Section 404(b).

The research also found that:

• nearly one in three organizations spends $500,000 or less annually on Sarbanes-Oxley compliance while just under half spend less than $1 million;
• external audit fees continue to rise for many but not for all organisations;
• the majority of organisations with mature SOX compliance processes have improved their internal control over financial reporting; and
• more than half of organisations have at least moderate plans to automate manual processes and controls in fiscal year 2016.