A newly released study by Foley & Lardner shows private organizations are increasingly adopting Sarbanes-Oxley standards even though they are not legally required to do so.  I learned over the past year or so that three of my colleagues who are responsible for information security or privacy at large private organizations have also been adopting the standards as a demonstration of due diligence following best practices.  They all indicated their board members and/or executives had encouraged...actually required...this so that the leaders themselves would be protected in the event fraud occurred within their organizations. 

So, the trend is there, and it really demonstrates that executive leaders must be motivated to drive information governance (security, privacy and compliance) actions, and then actively support them to get them effectively implemented.

Some of the findings listed within the article include:

"Among the findings:
  -- 86% of survey respondents felt that SOX and other corporate governance
     reform requirements have impacted their organizations, consistent with
     the 87% who responded in this manner in 2005.
  -- Private organizations continue to self-impose corporate governance
     standards, but are also strongly influenced by their boards and outside
     auditors.
  -- Private companies tend to adopt the least expensive reforms, as opposed
     to more costly initiatives such as Section 404 audits of internal
     financial controls.
  -- 84% of private organizations responding to the survey felt that
     corporate governance reform is "about right," an increase in comparison
     to 2005, when 78% responded in this manner.
  -- Private organizations responding to our survey estimated an average
     annual price tag of $105,000 for corporate governance procedures,
     representing an estimated increase of approximately 26% over their
     estimated costs prior to the enactment of the Sarbanes-Oxley Act."

It will be interesting to see how this trend impacts compliance budgets, along with information security and privacy budgets, as time goes on.

Technorati Tags
sarbanes oxley
corporate governance
compliance
SOX compliance