I think it’s fair to say that almost everybody has too many controls in scope for their SOX program.
That’s my experience from leading the SOX Masters training over the last 14 years with hundreds of SOX professionals. (Time flies!) Pretty much everybody left the class knowing they had work to do to trim (sometimes massively) their SOX scope.
It was confirmed in the recent survey I ran. Unfortunately, while hundreds read my posts asking for participation in the survey, only 22 did so.
But that small number still tells a story that should be considered.
Then I will give you some ideas for testing your company’s scope.
First, only 14% said their scope was not excessive.
Of the rest:
- 18% had 5% to 10% too many controls in scope
- 37% said they had between 11% and 20% too many,
- 23% had between 21% and 30%, and
- 9% said they had 31% to 40% too many
That is a lot of excess, costing a lot of money.
What is revealing is when people last redefined and made significant changes to their SOX scope:
- 5% said this year
- 23% last year
- 32% 2 years ago
- 5% each in 2022 and 2023
- 9% in 2021
- 23% in 2020 or earlier
In other words, only 28% had an up-to-date scope!
It is essential to revisit and refine the scope every year!
The business changes. Systems and controls change. Materiality can change.
Yes, it takes time and is a…
