Business process management: The future of SOX 404

January 25, 2005 —

By Michael Ramos

Section 404 of the Sarbanes-Oxley Act requires companies to document, test, and evaluate the effectiveness of their internal control. Complying with these requirements is proving to be complex, and not surprisingly, many management teams have looked to software solutions to help meet the challenge. To date, most solutions focus narrowly on the documentation requirements of Sarbanes-Oxley, using database functionality to capture, store and report pertinent information about controls.

Looking forward, when internal control monitoring and reporting becomes routine, management will require a more comprehensive solution than a warehouse of control descriptions. Anticipating these needs, providers of business process management software are beginning to offer solutions that ultimately may provide greater benefit to companies affected by Sarbanes-Oxley.

Act I: Documenting Control Procedures

The Limits of a Documentation Warehouse

Because of Sarbanes-Oxley, companies are now required to maintain documentation of significant business processes and the related controls. As business processes change, two things must happen:

The existing controls related to the previous business process must be evaluated and, if necessary, changed to reflect the new process, and
The company

ITworld.com