The rationale for shifting additional SOX activities to the first and second lines
SOX compliance time loops plague many internal audit teams due to its historical ownership, which has created a sense of comfort and stability for management. The clear guidelines and measurable outcomes of SOX work often overshadow the more ambiguous and evolving nature of strategic and operational projects. To break out of this cycle, organizations should rebalance internal audit’s focus toward strategic and operational audits, risk management, engaging with stakeholders to align priorities, and leveraging technology to streamline audit, risk, and compliance efforts.
As organizations evolve and regulations become more complex, some SOX activities can be shifted to a department or process owner (first line) or a risk or compliance function (part of the second line) if a dedicated SOX program management function doesn’t already exist. This can increase efficiency, improve performance, enhance risk management, and lead to a more robust and proactive management of SOX controls; like the head chef delegating some of their tasks to their sous-chef and kitchen staff. This transition allows internal audit to focus on its fundamental role of providing independent assurance, as discussed in the updated Global Internal Audit Standards.
Enhancing efficiency through role realignment and technology
Shifting some SOX activities to the first or second line allows internal audit to focus on high-risk and strategic audits. The first and second lines can use technology, such as automated tools and data analytics, to streamline SOX control monitoring and maintenance. This technology enables more efficient and accurate tracking of controls and compliance activities. As a result, internal audit can concentrate on evaluating control effectiveness and providing independent assessments, rather than updating SOX narratives. This approach optimizes the SOX process, improves the control environment, and better utilizes resources across all three lines.
Leveraging specialized expertise for improved performance
Achieving greater expertise from the first and second lines involved and taking more ownership of some SOX activities can enhance overall SOX control management. It allows organizations to be more careful and smarter about managing risks and putting controls in place — keeping a closer eye on things and fixing problems before they get out of hand. This can increase SOX compliance reliability, reduce control failures, and improve overall operational efficiency. According to Deloitte's A Practical Approach to SOX Readiness, "the responsibility for effective internal controls reaches beyond just finance and accounting and into other areas of an organization, and training is an important component of communicating roles and responsibilities over SOX throughout the organization."
Strategic resource allocation for greater impact
By transitioning some of its SOX compliance activities to other lines, it also frees up internal audit to focus on other high-risk areas like ESG or the impacts of AI on cybersecurity. As the first and second lines take on some of the more routine SOX activities, internal audit can concentrate on risk assessments, fraud detection, and serving as an independent strategic advisor. Many organizations’ SOX programs may be outdated and need to be refreshed, rethought, and modernized, according to Deloitte’s SOX Modernization: Optimizing Compliance While Extracting Value. This includes defining stakeholder responsibilities in order to ensure accountability. A monitoring program should track the effective operation of controls, risk identification, and mitigation. Control owners should be accountable for both the controls and the risks they minimize. All of these could minimize compliance costs and ensure regulatory compliance.
Transitioning SOX responsibilities to the first and second lines
While the benefits of transitioning SOX activities to the first and second lines are clear, the process itself can be complex and fraught with challenges. Organizations must carefully navigate these challenges to ensure a smooth and successful transition. The following are just a few SOX activities, frequently carried out by internal audit, that may be easily transferable to the first and second lines:
- Compliance documentation:
- Responsibility shift. Maintaining and updating compliance documentation, such as control descriptions, process narratives, and evidence of control operations.
- Internal audit’s role. Examine the completeness and accuracy of documentation, ensuring it aligns with SOX requirements and provides a reliable audit trail.
- Control testing and monitoring:
- Responsibility shift. Conduct ongoing monitoring and self-assessment control testing to ensure they are operating effectively and address any issues promptly.
- Internal audit’s role. Focus on validating and verifying self-assessment test results to ensure independence and objectivity in the evaluation.
- Issue identification and remediation:
- Responsibility shift. Identify and address control deficiencies and compliance issues as they arise.
- Internal audit’s role. Assess remediation efforts and the effectiveness of corrective actions taken.
The benefits of first and second-line involvement in SOX compliance
The involvement of the first and second lines in SOX compliance can yield significant benefits for organizations. These include:
- Improved performance and efficiency. Leveraging the first and second lines’ expertise improves control management, reduces deficiencies, and frees internal audit to focus on strategic, value-added audits.
- Enhanced risk management. Proactive risk management by the first and second lines can identify and mitigate risks before they become serious issues, making the organization more robust and risk-aware.
- Strengthened internal controls. With the first- and second lines’ continual monitoring and oversight, organizations may strengthen internal controls, financial reporting accuracy, and stakeholder confidence.
Challenges and risks associated with transitioning SOX responsibilities to the first and second lines
- Cultural resistance. Overcoming resistance to change is a major challenge as traditional roles in internal audit and the first- and second lines face uncertainty and pushback.
- Skill gaps and training. The first and second lines may lack the expertise for SOX compliance, requiring targeted training and development.
- Coordination and independence. Effective communication between all lines is crucial to avoid compliance gaps, while maintaining internal audit's independence to prevent role confusion.
Recommended strategies for a smooth transition of SOX responsibilities to the first and second lines
- Stakeholder engagement and communication. Involve all relevant stakeholders early, including internal audit, first and second line functions, senior management, and the board. Clearly communicate the rationale and benefits to build support and mitigate resistance.
- Training and technology integration. Invest in training programs and utilize advanced technology to enhance SOX compliance. Implement tech-driven solutions for skill development, compliance tracking, and reporting efficiency.
- Defined roles and collaborative oversight. Clearly document SOX roles and responsibilities with established reporting lines and accountability. Foster collaboration through regular meetings, joint risk assessments, and shared reporting, while leveraging technology for real-time oversight and updates.
