SOX and Program Management

So Anne asked me to write a note about how SOX compliance impacts the functions of a Program Manager for software development. My, have I struggled with writing on this topic and not airing too much dirty laundry or too much frustration!

As you’ve certainly heard (and possibly experienced) by now, efforts to comply with the Sarbannes Oxley legislation (aka "SOX purgatory") often impose many new processes that appear very bureaucratic to the people the processes effect. The toll on the Program (or Project) Manager can be significant, not only in terms of the amount of work and data collection required, but in terms of fielding questions and the nasty comments on "overhead" and "drain on efficiency."

Surely, some of these new mandates are bringing increased discipline - which can be positive - but the checks and rechecks and redundancy (did I say redundancy?) that come with it are more than burdensome. They are downright painful.

On the positive side, our project-focused data is getting cleaner than it ever has been. More people are being forced to learn more pieces of the process, which increases the overall understanding of the FULL process - and leads to many "ah ha!" moments. And more non-R&D people are learning better how to interface with R&D (and not just, for example, in Accounting-speak).

On the negative side, we have to have verifications and reports verifying the verifications. More people and functions need to be involved (which, as mentioned in the previous paragraph, is a positive in the long run), meaning the time needed to get compliance verification for a given quarter is larger in the short run. And for me personally, I live in Excel for a couple of weeks a quarter. Did John fill in the right box? Did Sue make sure to check those extra projects at the bottom? Thank goodness we have a massage therapist on site.

I don’t know if the Project Management Institute (PMI) folks are yet looking into adding questions to their certification procedures regarding SOX compliance, but I can tell you it takes up a significant chunk of time. I fully understand the intent of the law, but we need the auditors of the world to come up with realistic guidelines (and clarity) on the impact to organizations in various industry verticals.

What about you? Are you living with SOX? Any horror stories or successes to share? Let me hear about it!