Effectively Complying with Sarbanes-Oxley in Dynamic Business Environments: A Knowledge Traceability Approach

One of the most pressing issues facing IT managers today is the creation and maintenance of rigorous internal controls as part of compliance with the Sarbanes-Oxley act. The costs associated with complying with Sarbanes-Oxley are considerable. It is estimated that a total of 6 billion dollars were spent on Sarbanes-Oxley compliance in 2005, with the average firm spending $7.8 million and 70,000 work hours to comply. Three persisting problems contribute to these costs: (1) the ambiguity of the application of Sarbanes-Oxley requirements; (2) the large volume of documentation required; (3) and the difficulty of applying controls to changing business processes. This paper argues that the difficulties associated with complying with Sarbanes-Oxley are inherently knowledge management problems. Accordingly, this paper applies knowledge traceability concepts to create a framework that links the requirements of Sarbanes-Oxley to business processes