≡ Menu

Trends in Reported SOX Deficiencies

As a member of the IIA, I’ve been monitoring and commenting on their discussion forum over the last several months. An interesting question posed by a private-company professional was, “what are the current trends in reported deficiencies?”

As dumb luck would have it:

A colleague recently shared a paper from Compliance Week (Oct 12, 2004), noting that 51% of disclosures in recent months were due to problematic financial systems. Other big issues showing up as significant deficiencies/ material weaknesses: – Personnel Issues: segregation of duties, inadequate staffing/training, supervision issues- Tone at the Top (following instances of restatement)- Poorly documented accounting practices
An interesting read. For small businesses, I could see some of these issues. I’ve worked in immature organizations that are still trying to find their public legs. I can see where SoD comes up in small companies, and that training can be a challenge when you’re running lean and everyone must focus on operations.

But these are often multi-billion dollar companies. Not start-ups, but organizations with thousands of employees, of a size and market value that the investing public expects solid business practices to be applied at the helm.

What a sad state of affairs into which corporate financial practices have fallen. Coming from the operational side of the business, I find it astounding that so few departments have strong, repeatable, documented processes. It seems that many large businesses move on momentum: ask any serial entrepreneur what has resale value, and they will tell you – repeatable processes.

In conversation after conversation, the single biggest risk in my mind is that people are too busy chasing the little things to ever get ahead. Some of the brightest people I’ve encountered are also the busiest, far too busy to every teach anyone what they are doing, and therefore always shoulder to the grindstone. (Not the formula that I would expect to be applied in organizations trying to build capability – and by extension – shareholder wealth.)

Not that everyone is in danger of getting hit by the proverbial bus, but expert-specific risk is a very real exposure. Health-risks, burnout, separation, and -yes- getting hit by a bus all put the business at risk. We recruit these experts to build our organizations, but fail to capture that expertise in more than a transactional way. Task :: Completion. Problem :: Solution. This is not creating corporate capability – this is perpetuating a very real, unhealthy dependency.

SOX should simply be affirming what we already know to be true about building strong companies: you are what you measure. If you want to be successful, measure the elements that define success. Documenting practices, organizations are now forced to explain the process of expert knowledge in action. Maybe SOX is driving some much-needed-but-never-scheduled reflection on what makes a company healthy. A thought worthy of some personal reflection.