Managing 800 key SOX controls with no master matrix. Inability to identify most current and accurate individual control assessment status for lines of business and locations. Different standards of documentation.Unclear whether risks have been addressed or even assessed. Trying to determine a single source of truth depended on e-mails and then manual data aggregation and normalization.
As a result, status meetings couldn’t be held more than bi-monthly, and preparing for them took a quarter of that time period.A team of four was spending 300 to 500 hours a year, just to try and track status.
