Two recent postings on Search CIO around work AMR did on Sarbannes-Oxley caught my eye today - SOX: Seven steps to CYA and SOX: New rules for year two. In these John Hagerty of AMR makes a couple of great points:
In addition to reducing employee time, automated testing of controls enables companies to stop bad things from happening as they occur, not after the fact. To do this, companies can embed testing of internal controls right into the business processes themselves...
Now this is a clear call to use business rules, at least to me. The advantage of automation is clear from the articles but what is the additional advantage of automating with a business rules management system?
- Business rules can be numerous, especially for larger more complex companies. Business rules management systems have the repository, reporting etc you need to MANAGE these rules, not just implement them. As John points out "SOX is a process, not a project" - you will have to evolve over time.
- This kind of compliance tends to be better understood by those executing the process not by those writing the software. Good business rules technology will let you expose the rules being enforced to those who understand them so that they can do ongoing maintenance and tuning, in response to the feedback they get from dashboards etc, rather than having to ask IT to do it.
- Using a business rules management system to implement some kind of compliance decisioning backbone puts companies in a position to implement other kinds of company-wide decisions consistently, something that will help them get more value over time from this investment.
John says that "By automating the testing of some of these internal controls, you will reduce the cost of compliance by upward of 25%, and we think that is actually pretty conservative." I would have to agree with him - these are the kinds of cost savings we have seen from using business rules in other circumstances.
So, treat SOX as a process and an opportunity and use business rules to automate it for lower costs, better results and more long term opportunities.
