Like the blind men describing an elephant, SOX is not the same thing to all functions within the company and therefore the Year 4+ decision of the SOX final resting place becomes difficult.
An old East Indian story is of the four blind men who describe the elephant based on their perspective of what part of the elephant they have touched. The one who touched the trunk announced the elephant is like a large snake; the one who touched the tail said it is like a rope; the one whose arms encircled a leg said an elephant is like a tree; and the one who felt the side was certain the elephant was like a wall.
As companies move beyond SOX Year 4+, three options have emerged: 1) make SOX part of the Compliance program; 2) move the SOX controls into Risk Management; or 3) continue the SOX offices as an individual entity.
For the Financial areas, which have the ultimate responsibility for assuring there is no material error in the financial statement, Risk Management provides good methods of documenting the numbers that were provided by the reporting organizations. SOX documents the traditional Finance manual controls over the final assembly of the annual report.
See full Article.
Posts
