Sarbanes-Oxley has passed into the corporate consciousness. Companies now know that compliance does not come cheap. One of the ways management and auditors are looking to reduce costs but still maintain quality is through automation.

Is there a silver bullet somewhere that will magically remove the pain of Sarbanes-Oxley, whilst at the same time producing the benefits that were promised from it?

Of course not, is the simple answer. No more than it is possible for traditional load or automated testing.

Significant up-front costs, training and the possibility that it may become redundant if Sarbanes-Oxley is repealed or made radically insubstantial.

How then to proceed? In my humble opinion there are three stages in any automation programme. They apply whether we are load testing, preparing for Basel II or the infamous Section 404 on internal controls.

 *Hire good people
 *Have those good people do good things.
 *Automate the good things done by the good people.

How does this map on to compliance with Sarbanes-Oxley? In the first instance the people are already there in the shape of management and auditors. Whether they are any good is a different matter.

The company/audit firm can hire in of course, but that can be expensive. The right skills though are worth the price.

Should the existing personnel not be up to scratch, then they will not be able to perform the second stage, and it will degenerate either into chaos or become a box-ticking exercise. Either way, any attempt to automate will only compound the problems.

The second stage is more problematic. Guidance from the auditing bodies and the SEC was initially sketchy on what to report and concentrate on. Consequently, auditors have had a tendency to go overboard and examine every single internal control, no matter how trivial.

Management was also on a steep learning curve. Many have complained that they are not running a fraudulent company, so why should they be treated as if they are an Enron waiting to happen.

The passage of time, companies having been through the process and guidance from the SEC/PCAOB means that we have a much clearer picture of how to comply. Throughout the coming year, I predict a far wider range of companies taking on automation projects for Sarbanes-Oxley compliance.

Related Articles
Citigroup and Reveleus
COBIT Update Released
Sarbanes-Oxley Glossary
Basel II Banks Having Doubts
Control Documentation Tool Requirements
Internal Control Documentation Tools