SmartSOX

SOX compliance testing is an assessment of the company’s internal control processes related to financial reporting. SOX compliance testing helps a public company show investors, employees, and other stakeholders that it has procedures in place to prevent fraud and that the financial reports the company produces are accurate and reliable.

The initial SOX controls testing is often performed by management as a self-assessment, or by a dedicated SOX team, followed by an assessment performed by independent auditors. When the testing is done by management, they are testing their own processes. In this form of testing, there is very little independence since management is involved in both the control operation and in the SOX testing process.

Testing is occasionally facilitated by an internal audit team who publishes a self-assessment to managers, who will respond with documentation for the internal auditors to validate. Some companies have a dedicated SOX team that is part of the management team, acting as a compliance group and therefore is not fully independent. SOX teams are removed from the control and better positioned to provide unbiased test results. After the testing is completed, an internal audit team may perform independent testing. Since the internal audit is independent, others may be able to rely on the SOX controls testing they performed.

Today’s business environment is very complex and is becoming increasingly automated. Numerous applications comprise the enterprise ecosystem and therefore multiple sources of risks exist. Most importantly, the need for auditing the information access control in a continuously changing application environment.

This poses the need for continuously auditing the enterprise systems, combined with overall exhaustive audit activities throughout the year.
Even more importantly, while all these challenges are intensifying over time, the audit resources remain limited. Time availability is also limited. While in the meantime support from the business side is also restrained to the minimum.

This poses the question; how can your organization manage the important activity of SOX compliance testing? How can you manage this with your available resources and limited time? How is it possible to move on to smart compliance testing and collect the best samples for a most effective auditing process?

SmartSOX is used as a proactive measure to keep productive systems in compliance with SOX and mitigate risks before they are identified in future reviews. The tool can be used before the official reviews or after a major change request has implemented in a system, to proactively check for violations and risk early in the process to take immediate remedial action.