November 03, 2022
SOX Risk Mitigation: How PayEm brings compliance to its customers
Sign up for our newsletter
Stay informed with the latest trends and best practices in finance and procurement.
SOX Compliance is nearing its 20th anniversary. Intended by the Sarbanes-Oxley Act to protect the general public from the fallout of corporate financial malpractice by augmenting the corporate governance performed on financial transactions, including enterprise payments. For that, SOX has created a framework that requires companies to document their procurement and payments approval process in a way that creates a properly documented audit trail.
Since its introduction in 2002, SOX has transformed into the standard legal framework dictating what finance teams can do vis a vie the use of technology. Unfortunately, as companies have come to rely more and more on third-party technologies, SOX has made it difficult for companies to modernize and scale, thus leaving them with outdated, manual processes.
At PayEm, we identified an opportunity to automate the Procure-to-Pay process by enabling the entire workflow to be governed via an easy-to-use SaaS platform, one which does not require code interactions with companies’ ERP systems. That said, we recognize the importance of ongoing SOX compliance while empathizing with the finance departments that find their actions constricted due to SOX regulations.
That’s why our Financial OS has been designed from the ground up to be fully SOX & SOC 2 compliant across the board, from request to reconciliation. Not only does it mitigate and control the risks associated with SOX, but it also allows finance teams to do so much more while remaining compliant, from reimbursement procedures to custom approval flows, automatic transaction records, and more. Thus, we have created this report highlighting how PayEm addresses and manages instances of SOX compliance risk.
Here are the ways PayEm can impact and help your Company maintain proper SOX compliance while optimizing and automating your procure-to-pay business processes, thereby maintaining a high degree of diligence, controls, and audit trails for your finance organization.
Risk 1: Payments
When the records and totals of a company’s payments are deemed incorrect, whether due to time period or transaction code, this poses a significant risk to SOX compliance. PayEm’s platform nullifies this risk by allowing clients to decide their own payment methods and controls, which automatically document, date, and code all transactions, as dictated by company policy.
Risk 2: Segregation of Duties
Segregation of duties is an essential method by which companies keep sensitive processes from being manipulated by a single person or function. When data is universally accessible, the danger of leaks and data breaches goes up significantly, thus presenting a risk to SOX compliance. PayEm offers different permissions for different roles, with support available for multiple entities and subsidiaries. These roles include Admin, Accountant, and Employee, and their respective permissions are fully customizable. Each user type has access to only the information they need to perform in their roles.
Risk 3: Travel Expenses
Travel expenses represent the single largest discretionary spending item that most companies face. That said, the methodology behind travel expenses and approval often differs between companies and industries. Given this lack of universality, businesses that have not established a solid review infrastructure may find that travel requests and reimbursements fall through the cracks, thus posing a potential risk to SOX compliance. Moreover, even when solid review infrastructures exist, they are often based on manual reports and functions that can be easily fabricated. PayEm allows control of travel expenses through policies concerning fund requests and reimbursements, customizable approval flows, and specific budget allocation to specific employee cards. The entire process documents itself automatically within the OS, from end to end.
Risk 4: Unauthorized Transactions
SOX is a framework and methodology by which businesses must govern their policies and processes concerning approvals and payments. In that regard, unauthorized transactions are a significant part of what SOX compliance aims to protect against. In other words, it seeks to force businesses to set up an internal ecosystem that automatically protects against such scenarios. So, if a reimbursement, purchase, or transaction occurs in opposition to a company’s policies or authorization processes, this could indicate a SOX compliance failure.
On a high level, PayEm addresses this by ensuring that the entirety of a company’s spend is approved in accordance with set policies and procedures, all while enabling ERP independence and automatic documentation. Moreover, PayEm assists by supporting the customization of policies for reimbursement and the creation and approval of Purchase Orders.
Therein, admins can set threshold amounts, along with custom approval flows, that vary by department or other criteria. The employee can only be reimbursed or assigned a dedicated credit card, depending on the request in question, once they receive approval. Upon reconciliation, all transactions will be automatically associated with a PO and synced to the ERP. Moreover, the complete details regarding each phase in the process, which are automatically documented within the system, can be pulled via reports for any reason at any time.
Risk 5: Inaccuracies & Omissions
Though neither malicious nor intentional, inaccuracies and omissions as caused by human error (via manual processes) can be incredibly damaging to a company’s potential SOX compliance. Such errors may include incorrect purchase coding and invoices whose prices/quantities/time periods do not match. PayEm resolves these risks through automation of the reconciliation phase.
PayEm uses an advanced scanning mechanism that automatically matches receipts to transactions, the review of which is possible during reconciliation via a form of auto-bookkeeping. In turn, this completely eliminates all possibility of human error. If anything is missing, responsible parties can easily and retroactively match receipts. Once all transaction details are verified, the finance person can sync them with NetSuite or another ERP.
Risk 6: Process-Policy Alignment
The key to the financial efficiency of any business is to ensure that policies and the processes meant to support those policies are in alignment. For instance, if a company’s finance team says to open a purchase order only above a certain threshold, and employees submit them below, imagine what other policin y-process disconnects may occur - thus posing a risk to SOX compliance.
With PayEm, finance teams can add processes and levels of authorization (via custom approval flows) that function per set policies, whether for fund/reimbursement requests or PO creation. These code-free, lifecycle management customizations can be implemented with complete independence from the ERP. In other words, this function makes anything other than total process-policy alignment impossible. This
Conclusion
When looking across all of PayEm’s capabilities, it’s clear that our Financial OS can assist businesses with mitigating potential SOX compliance risks. All told, 21st-century organizations deserve 21st-century solutions, even when constrained by twenty-year-old compliance mandates. With that in mind, we will continue to develop tools and automations that enable companies to operate within those parameters in a successful and risk-free way.
