What you need to know about UK SOX
A UK equivalent to the USA’s Sarbanes-Oxley Act has been in the works for some time, it looks as though launch day is edging closer and closer. If you’re a director in a UK company, SOX compliance is something you’re going to need to know about. In a bid to help our network navigate this new regulation, we’ve pulled together this guide to cut through the noise.
The two main divisions to be affected by SOX are finance and IT, and as such they need to be firing on all cylinders in the first instance. You might want to review your current systems, people and processes in both teams to ensure they're going to be as collaborative and effective as possible.
Develop protocols and coordinate testing through a SOX steering group. As with any regulatory change, having a dedicated steering group can prove to be an invaluable mechanism to help you drive a big change through and keep it on track.
To build a truly embedded controls procedure that is adopted business-wide, you'll need to spend time ensuring everyone from c-suite to junior levels are on board. Training should be your first port of call for ensuring everyone sticks to the process.
Chances are that you rely on some form of third party environment for processes or data flows. Knowing their role in your SOX programme is vital to understanding potential risks and how to mitigate them.
Keep things consistent and avoid changes to your process by clearly defining your approach to identifying, documenting and evidencing key financial controls. Otherwise you may find yourself losing budget and time during the design and implementation phase.
Start with a comprehensive risk assessment to ensure your programme is as sustainable as possible, then define your process and control owners for each stage of the plan so everyone knows which elements they're responsible for.