The cost of your SOX documentation has likely already been accounted for, and if you are like most organizations, you’ve already decided how you will address the ongoing maintenance and testing requirements that are now part of the publicly traded landscape.

One of the considerations that has been getting some discussion is how value can be built on top of the analytical work and assessment that SOX required. If you have ever undergone a business process improvement project or have a business process management function (BPM) that facilitates change in your organization, you are probably aware of the costs surrounding the “how do things work today” assessment. SOX documentation should give you a head start.

Should – this is the critical watchword, and this notion comes with caveats. If you’ve ever tried to pick up someone else’s speech, or inherited a process from someone else, you are familiar with the orientation challenges to recycling the work of others. Most documentation has a slant to it, in that the original author typically has been writing for an explicit purpose, which is probably different than yours.

The SOX documentation floating about your organization should provide a very concise orientation to the critical transactions that result on your financial statements – this was the driving purpose to the thousands of hours of documentation that preceded the flurry of testing. The intent of this documentation is to provide an external auditor that isn’t necessarily familiar with your process an adequate overview of how the transaction moves from initiation through the process and ultimately to the financials.

SOX documentation is very risk and control centric: the point is to demonstrate that investors can rely on the financial results because a series of key activities (controls) are being regularly executed that ensure the accuracy of the financial results. While it contains flow and systems details in varying depth, these are represented to help a reader understand effectiveness of the controls – not efficiency.

“Effectiveness” is the SOX objective, at whatever cost to efficiencies in the process. And therein lies the opportunity: an objective review of your controls will tell you what is being done efficiently (automated controls, or controls embedded in the process itself) and what is only being done effectively (manual reviews of printouts and signoffs that happen offline to ensure proper authorization). Business Finance published a recent article on the value that can be realized through BPM efforts, which might be useful as you make your case to senior management.

In considering a BPM technology initiative, your SOX documentation should provide a few useful data points to get you started. It is reasonable to expect:

• An overview of the transactions from initiation to reporting
• Identification of the workgroups involved (assuming that swim lane diagrams or narrative descriptions have been oriented this way)
• A clear balance of current manual and automated activities that are relied on to get comfortable that the transactional data is being captured and processed appropriately.
  Walkthrough and testing documentation that reflects the nuances of the control operation, including the use of the applications, spreadsheets, and other information necessary to evaluate if the transaction is being processed correctly
• Business owners painfully aware of extra work that has been layered on them to meet the law (effective), but is hampering their day to day work efforts (efficiency)

You will not likely find:

• Specific identification of process bottlenecks in the flow from initiation to reporting
• A well-crafted list of grievances resulting from new manual processes slammed into place to meet regulatory guidelines
• System development roadmaps that consider SOX requirements along side the demands of operations

The pain point exists, and the timing is excellent for companies deep in Year 2 of their efforts, where considerations of efficiency are now being put back on the table. Tapping into the vast knowledge store required for SOX is an excellent way to turn sunk documentation costs into a base of investment for business transformations.