According to Protiviti's newly-released report: "Benchmarking SOX Costs, Hours and Controls" on the results of its survey of nearly 700 public companies conducted earlier this year (for fiscal 2018), average SOX compliance costs overall declined year-over-year (but remain significant - see page 7), while external audit fees increased for most companies. More than half of companies overall reported an increase in the hours they devoted to SOX compliance, with nearly 60% of those companies reporting an increase of more than 10%. More than half of companies use outside resources (co-sourcing or outsourcing) for SOX compliance activities relating to process controls and IT controls.
Notably, 45% of respondents reported being required to issue a cybersecurity disclosure according to the SEC's guidance – on par with last year's report, but up from 33% the year before. SOX compliance hours increased more than 16% for 37% of companies required by the guidance to make a disclosure.
The report includes instructive benchmarking data on controls testing, auditor reliance and automation; key controls; the use of technology; and other relevant practices/processes.
See also Protiviti's release & infographics, Deloitte's "Reboot SOX Compliance With a Modernized Approach," and additional resources on our Auditing and Financial Reporting pages. This post first appeared in the weekly Society Alert!