Unless CIOs do Sarbanes-Oxley differently this time, it will cost even more money and cause even more pain. Here's how to avoid all (or at least most) of that.

The dirty little secret of the first Sarbanes-Oxley audit is that no one really knew what they were doing. Not the auditors, not the consultants, not you.

For Al Schmidt, vice president of IT for Arch Chemicals, that became painfully obvious during a September 2004 meeting in which his internal auditor, PricewaterhouseCoopers (PwC), and his external auditor, KPMG, discussed . . . auditing standards. (Sarbanes-Oxley mandates that companies have different internal and external auditors to avoid Enron-like conflicts of interest.)

As Arch employees and about five auditors from each firm sat silently, the lead partners of the two firms went back and forth for about 20 minutes, debating the different methodologies that each was using for the Sarbanes-Oxley 404 review of the $US1.2 billion specialty chemical manufacturer's internal controls.

"Let's just say it was a learned discussion between two parties," Schmidt says.

"I was surprised that those details hadn't been ironed out ahead of time," he adds. "That was my introduction to the fact that the underlying issues [with the Sarbanes-Oxley audit] were not firm."

For Schmidt, that was also the beginning of a constant tug of war with his auditors, as control after control had to be created, tweaked or clarified. At times, it seemed to him as if the auditors were making up the rules as they went along. As a result, he feels that he only had time to react, focusing on passing the audit as opposed to coming up with long-term solutions to the weaknesses the audit exposed. He estimates that from the time the PwC consultants finished their first review of his controls in the late northern autumn until the end of the KPMG audit in mid-February, he devoted fully half his time to the audit.

"The auditors kept coming up with issues," says Schmidt. "It became time-consuming, well in excess of anything I've ever experienced."

The Winter of Your Discontent

Schmidt's experience is typical. CIOs at companies with fiscal year-ends falling between November 31 and December 31 spent the last months of 2004 and the first months of 2005 on tasks ranging from developing controls for restricting user access in certain parts of certain systems to (according to Robert Sell, vice president and CIO of Eaton, a $US9.8 billion industrial manufacturing company) taking digital photographs of the smoke detector in a backup server closet.

And sending the auditors receipts for the batteries.

In almost every case, the controls that CIOs put in place were manual. Forrester Research estimates that fewer than 1000 companies in the US actually bought Sarbanes-Oxley software in 2004, and CIO has found that a number of companies that did haven't yet deployed it. There was just no time. Reflecting on her own Sarbanes-Oxley experience, Ann Harten, senior vice president and CIO of Sirva, a $US2.3 billion relocation services company, simply says: "We have to find a way to make this less painful."

But unless CIOs approach the second Sarbanes-Oxley IT audit differently from the first, chances are good that it will take even more time, cost even more money and cause even more pain. In the rush to meet the audit deadline, many CIOs put more controls in place than they really needed. That resulted in a lot of unnecessary work, which may actually double this year as they try to prove that those needless controls are being used. So while last year CIOs had to assign someone to check an application audit log, this year, in order to pass the audit, they will need to demonstrate that the check was performed regularly - a documentation challenge fully on par with last year's effort to install the control. In other words, Sarbanes-Oxley compliance has to be treated as an ongoing process. And the only way to follow this new process without crippling the IT department will be to automate as many of these controls as possible. If the audit log can be checked (and that check documented) by a computer, then a person doesn't have to do it.