Software Consultants = lots of money 1901



  • Does anyone have experience with setting up a SOX software solution in addition to getting advice/guidance from SOX consultants?
    We’re still in the process of choosing a SOX software solution and we’re finding out that we will most likely ALSO need to enlist the assistance of a consulting firm (at least at the beginning) to get us off the ground and set us in the right direction. We were originally under the mistaken impression that the software would take the place of consultants.
    I know that all cases are unique, but can anyone tell me whether this sort of ‘hybrid’ approach to SOX compliance is common practice?



  • Hi Albie - The title of your post says it all 🙂 Your question is excellent and hopefully your company can implement SOX without major expenditures.
    Not only can SOX software be an expensive endeavor for a company. Your external auditors might provide some insights on software or consulting – as long as they are not recommending themselves as consultants 😉 While I’m in IT, I think within our company most of our SOX solutions are ‘homegrown’ rather than meeting these needs through consulting services or purchasing new software.
    Some ideas that may or may not be applicable for your company:

    1. Determine your own needs … In using either consultants or software, make sure it’s a business need that cannot be solved in any other manner (e.g., you don’t want to do the opposite which is ‘purchase software in search of business reason or solution’).
    2. Plan and research extensively … You’re far better served by becoming versed in SOX requirements and tailoring a solution for your company, rather than letting external folks come in and do it for you.
    3. Get internal training … The SOX coordinator should be thoroughly trained and you can visualize this as a ‘train the trainer’ approach where they can pass on this to the other core team members
    4. Set up a Project Plan for SOX … Just a home is better built from a blueprint, the same principal applies for SOX, where a good plan can save your company USDUSDUSD by doing it right the 1st time.
    5. Work with audit … Get advice from your external auditors on software products if needed (e.g., for things like change management, software promotional controls, documentation tools, security products, etc).
    6. Reference checking … If you need either outside people or software, get references from folks who have used their services or tools in the past. If you need a software product for better change management for example, make sure it’s efficient and has benefits beyond just meeting SOX requirements.
    7. Consulting contracts … If you need expertise or augmentation to get a good jump on SOX, you might go with a short term contract with options to extend or renew. I personally don’t think SOX is difficult to implement with the appropriate needs assessments and education, so careful structuring and contractual language may also save USDUSDUSD
    8. Use Electronic storage over paper … Strive for an efficient and paperless SOX compliancy environment where you can.
    9. Senior Management backing … No project is successful without executives being on-board and backing the SOX effort when ‘turf wars’ or special needs surface.
    10. Continuous education on SOX requirements … These forums can provide a good resource to ask questions and help save costs from those who have successfully adopted and met requirements. We all need to follow new developments (e.g., SOX 2007 changes to improve requirement). You might join PCAOB or obtain obtain COBIT 4.0 or COSO documents also.
      Good luck on your efforts and hope that you can do this in a cost effective manner 🙂


  • Hi Albie,
    If you would like to discuss offline, I am open to providing feedback. I have recent experience implementing a SOX IT Tool and used a consultant to implement it.
    404cpa at gmail dot com
    /the address info is adjusted thanks to Harry’s good feedback.



  • Hi Milan, could you please tell me which IT Tool have you implemented? I am looking for a sox software that I can implement in this year in the company where I work. Are you satisfied with your IT tool?
    Thank you very much for your feedback. :lol:
    Katia
    Hi Albie,
    If you would like to discuss offline, I am open to providing feedback. I have recent experience implementing a SOX IT Tool and used a consultant to implement it.
    404cpa at gmail dot com
    /the address info is adjusted thanks to Harry’s good feedback.



  • Hi Katia and welcome 🙂
    You might also email Milan at the address below. Don’t use spaces when you sent it out, (as this email format is to keep automated web malware from capturing email addresses used in spam attacks):
    404cpa at gmail . com



  • Hi,
    Oracle Internal Controls Manager (OICM).
    If you would like comments about the product, please write me at 404cpaATgmailDOTcom
    Sorry for the archaic address, but this site has a policy on hyperlinks.
    Milan



  • Be wary of consulants. My experience is they cost a lot and usually do not set a foundation to build on. This way they can entice you to use them every year.



  • I’m inclined to agree with Nicky.
    Most of the consultants we met with appeared to have a lot of technical knowledge, but very little practical knowledge on how to apply SOX as best fit within an organisation.



  • Good points and when using consultants to jump start a project or to augment existing resources, some of the following guidelines should be established:



  • As a few regulars on this forum will vouch, I am more than agreeable to provide feedback about using consultants and to share experiences at my anon email provided earlier. However, I try to avoid discussing these matters in an open forum.
    Too bad that websites like epinion.com or other similar ‘product/service’ review websites that allow users to post anonymous feedback about experiences do not cover the use of consultants.



  • Be wary of consulants. My experience is they cost a lot and usually do not set a foundation to build on. This way they can entice you to use them every year.
    I won’t blame the consultants for everything. A lot depends on how much competent person you have in your place to understand the system and use it. Most of the time companies assume that a tool is supposed to do everything and a person is hand picked from the rolls to maintain it.
    Calvin



  • The problem with Consultants is usually that their clients are not clear what they want from them. Time and time again I see senior management doing things like engaging a firm to ‘do SOX’ for them without a clear idea of what that means nor how they are going to manage the consultant.
    Working with Consultatns can be extremely valuable if you have a clear idea of what you want and they have the skills to do it.



  • I also agree with the feedback by Denis and Calvin … Consultants can bring valuable experience and expertise into an organization and may make a significant difference. In some cases the company may not have an option to add to staff.
    Still, our ‘mileage may vary’ based on the actual consultants that are used for special projects and most importantly how the company manages them. Thus if they are needed, checking references and interviewing them are helpful to ensure a good fit.



  • Working with Consultatns can be extremely valuable if you have a clear idea of what you want and they have the skills to do it.
    This is the real picture.



  • I agree with you that if the client understands what the consultant can provide them with, and the consultant knows what his/her client’s expectations are, then, such an engagement is going to be of enormous benefit.
    The concerns that I have raised relate only to the number of consultants and software companies that ‘Cold- Call’ me on a regular basis, but are unable to explain of what benefit they can be to us.
    Certainly, if I were to engage in the hiring of a consultant, I would have a clear idea of what our needs were, and, if so, I wouldn’t be sitting around waiting for someone to call me, advertising their services.[/quote]



  • (sorry about the typo - there should be no quote reference above)


Log in to reply