For 5 years, the software company Workiva has partnered with a LinkedIn group, SOX and Internal Controls Professionals Group to survey companies about their SOX compliance program.
Their 2020 State of the SOX/Internal Controls Market Report has some interesting content. 428 professionals responded, making it quite credible.
One of the early observations in the report is about the number of key controls and how many are labeled as ‘entity-level’.
Unfortunately, while they say “there is a correlation between the number of controls and the size of the company’s revenue”, their graphic makes it hard to see the average number of key controls for different size organizations.
One of the points I make in my SOX Masters training[1] is that as revenue grows, so should materiality. As a result, the number of ways in which an error could occur that would cause a material misstatement of the consolidated financials shrinks. The correlation between the number of key controls and revenue should not be anything like a straight line.
While 48% of the respondents have 250 or fewer key controls, 15% have more than 1,000.
No wonder that one of the observations in the survey is that people are looking to drive efficiencies into the program.
In my book and class, I talk about the fact that there are multiple levels in…
