Governance, Risk and Compliance

Is SOX too costly?

junesunus — Thu, 05 Jun 2008 06:25:42 +0000

Since Sarbanes Oxley became the law in 2002, the average cost of compliance for companies with revenue less than 1B has risen from 1.7 M to 2.8 M in 2006, a 165% increase since 2003.

For companies with annual revenue over 1B, the average compliance cost increased by 54%, from 8.1 M in 2003 to 12.4 M in 2006.

Is SOX compliance too costly?

Is it not surprising that many companies are thinking about going private or merger and acquisition, because of the increasing cost of compliance. This is also the concern for foreign companies who is considering the listing on US stock market.

After 5 years of SOX, it is the time to strike the balance of cost and benefit with both regulations and technology.

The regulation is becoming more realistic with the release of AS5. And, there are tons of technologies and software, which can help improve compliance efficiency.

Recent numbers from Michael Rasmussen at Corporate Integrity blog, GRC market is sized as below:

GRC Professional Service Market is $40.6 billion in 2008.

GRC Technology Provider Market is $9.3 billion in 2008.

GRC Information/Content Provider Market is $2.2 billion in 2008.

SOX compliance is still one of the major drivers for GRC market. Driving efficiency, reducing the SOX compliance cost, and streamlining operational processes remains still remains the top priority.

The good news is that there is plenty of room for innovation and co-existence of many players, large or small.

GRC Market Overview and Trends

junesunus — Mon, 31 Dec 2007 08:13:16 +0000

How was GRC doing in 2007 and what are future trends in 2008 and beyond? A recent report by John Hagerty from AMR said it all:

Top areas of GRC addressed in 2007

Code of conduct – training requirement, document/record retention, financial reporting – SOX

Largest GRC investment by initiative

SOX is still the top priority in terms of investment.

SOX spending since 2003

Total of spending 32.3 B with estimated 6.0B for 2007, 6.2 B estimated for 2008. Among 32 B, total consulting 23.7B and technology 8.6B.

Top benefits for GRC

Streamline the business process is the highest ranked, and visibility to operations is coming to picture.

Other emerging trends

Sustainability and Corporate Social Reponsibility; security & privacy, record retention, IT control…

Delay on Sec. 404 for SME

junesunus — Tue, 18 Dec 2007 05:11:52 +0000

SEC Chairman Christopher Cox plans to propose giving non-accelerated filers another year’s extension before they must get an auditor’s attestation on their internal controls, as required by Section 404 of Sarbanes-Oxley. Speaking at a House committee hearing Wednesday morning, Cox said the SEC will launch a study of Section 404 costs and benefits early next year; according to Cox, forcing non-accelerated filers to comply with Section 404(b) before that analysis was complete would be unwise.

Oracle launches GRC initiative for partners

junesunus — Mon, 12 Nov 2007 07:41:09 +0000

According to AMR Research, governance, risk and compliance spending will reach US$29.9 billion in 2007, an increase of 8.5 percent over 2006. In 2008, this number will increase an additional 3.6 percent to US$31 billion.

Available to select members of the Oracle PartnerNetwork who deliver security and/or compliance solutions or services complementary to Oracle’s, the initiative helps create a partner ecosystem offering world-class, integrated, comprehensive solutions and services for access control, data protection and privacy and compliance management, based on Oracle Applications and technology.

http://www.oracle.com/corporate/press/2007_nov/11-8-07-grcpartnerstrat.html?rssid=rss_ocom_pr

Gartner’s top 10 for 2008

junesunus — Tue, 23 Oct 2007 06:31:50 +0000

Gartner listed top 10 strategic technologies for 2008:

The report lists the following as the top 10:

Green IT
Unified Communication
Business Process Modeling
Metadata Management
Virtualization 2.0
Mashup and Composite Apps
Web Platform and WOA
Computing Fabric
Real World Web
and Social Software

New internal control monitoring guidance by COSO

junesunus — Wed, 10 Oct 2007 05:47:29 +0000

COSO has released the new guidance for companies to conduct ongoing and special purpose minotoring. The new guidance provides the tools and examples that will help companies more thouroughly understand the monitoring component of the IC framework. It also demonstrates how monitoring controls integrates with management’s responsibility to perform 404 assessment in a cost effective way.

The 40 – page draft has been released. COSO is seeking the feedback by Oct. 31. The final version is scheduled to be released for Q1, 08.

http://www.coso.org/publications.htm

Oracle buys Logical Apps

junesunus — Wed, 10 Oct 2007 05:29:38 +0000

As a step forward to strengthen the GRC leadership, Oracle announced to acquire Logical Apps, a leading compliance vendor for Oracle applications on Oct. 9, 2007

http://www.oracle.com/corporate/press/2007_oct/logicalapps.html?rssid=rss_ocom_pr

What is GRC?

junesunus — Tue, 18 Sep 2007 05:27:03 +0000

One of the best explanations of GRC I’ve came across is from Michael Rasmussen, VP of GRC research from Forrester. Most poeple try to explain GRC in separate components, G, R, C. Michael explains it in a more cohesive way and a good analogy: a three legged stool

’The purpose of GRC is to provide sustainability, consistency, efficiency, and transparency for the multiple GRC processes in the organization. This is achieved by encouraging collaboration among the roles responsible for GRC (e.g., corporate secretary, corporate compliance, enterprise risk, audit, IT, line-of-business, investigations, legal) as well as leveraging a common framework and technology infrastructure.’

Oracle Buys Enterprise Role Management Leader Bridgestream

junesunus — Mon, 10 Sep 2007 06:03:31 +0000

REDWOOD SHORES, Calif. 05-SEP-2007 05:01 AM Oracle today announced that it has acquired Bridgestream, Inc., a leading provider of Enterprise Role Management software. Enterprise Role Management has emerged as a key component of identity management deployments to improve overall security and address regulatory requirements. By adding Bridgestream’s leading role discovery, definition and management capabilities to Oracle’s widely adopted access management and user provisioning solutions, Oracle provides the most comprehensive and feature-rich identity management solution. Oracle’s Identity and Access Management Suite is a component of Oracle Fusion Middleware, the industry’s fastest growing, most standards- compliant, and best-of-breed technology foundation for Service-Oriented Architecture.

For more details: http://www.oracle.com/corporate/press/2007_sep/bridgestream.html?rssid=rss_ocom_pr

First AS5 audit – auditor’s and company’s views

junesunus — Mon, 10 Sep 2007 04:22:36 +0000

As large public companies are approaching the first reporting cycle under AS5, how are auditors and companies planning for their first AS5 audit?

After digesting several articles at Compliance Week, I have listed some important findings from both auditor’s and company’s view and opportunity for GRC software.

Auditors’ perspective:

For auditors, most noticeable impact lies on two areas: 1) how can auditors reduce the number of site visits for control testing; 2) how much can the auditor rely on company’s internal auditor and other consultants’ work to reduce the number of walkthroughs

In the previous AS2, in terms of testing at company locations, there was coverage threshold to meet. Now, although it was not expected to change dramatically, auditors have more flexibility to determine which locations should be included and which should be excluded base on the risk assessment. Over the time, a more systematical way to make the decision on location will be formed.

While AS2 required auditors to perform their own walkthrough for key controls, AS5 gives auditors more flexibility to leverage company’s internal controls or other consultants’ work under auditors’ supervision. To companies, it means they can decide to allocate more of their staff to free external auditors. And, auditors may rely more on third party external resources. In either way, the goal is to have more effective walkthroughs.

Company’s perspective

Companies will focus on risk assessment to decide the critical risks and decide how much risk assessment. Under AS5, risk assessment will drive the decision making around what and when to test, who should test and how it should be done. A better job done by the company will enable auditors to leverage their work and to maximize the outcome, although the balance needs to be maintained.

Opportunities for GRC vendors:

The more auditors can rely on company’s internal control work, the more is needed for companies to provide automated controls and more documentations. It provides more value proposition for GRC software in improving compliance efficiency and reducing the overall costs.