4 ms·

what is the cost of Sarbanes-Oxley compliance to the company in dollars ?

by vasilipupkin 11y ago

batbomb 11y ago
the salaries of a good CFO and a few lawyers.
- phamilton 11y ago
  As an engineer at a company recently acquired by a public company, we had a decent amount of work to do to become compliant. Code review, deploy procedure, etc all needed to be documented and formalized. These weren't too difficult, but they definitely tied up engineering resources for a decent amount of time.
  - batbomb 11y ago
    Yeah, my impression is that if you are a decently organized company it's a piece of cake. If you have mountains of technical debt, spaghetti code and no build processes, dozens of SaaS products, zero documentation, piecemeal authentication/security, etc... it can becomes quite onerous.
    - phamilton 11y ago
      For us it was a lot of simple things. Change management was the biggest pain but in the end it was just an extra step in our build process. Our canary process was a bit hands on (find a host, deploy to that host, tcpdump/check logs to validate the changes were correct and in effect). We stopped doing that. I can't decide if we are building better software without that as a crutch or if we are just not seeing production issues. Anyway, it's stuff like that. Little shortcuts here and there. Nothing major, but it required behavioral change within the org.
phkahler 11y ago
I'd prefer the cost in humans. How much staff does it take to ensure compliance. That's helps you figure out what size the company has to be since you might have to hire a few people. For a 500 person company it's no big deal. How big was Cruise when GM went to buy them? I think too small to have done an IPO and part of that is that they were too small to have hired the extra people for compliance.
nopzor 11y ago
It costs few million dollars a year just to be a public company, SOX compliance included.
saosebastiao 11y ago
There's an accounting cost, but it's the tip of the iceberg. The real costs add up when even entry level employees (like myself working for a Fortune 500 out of college) hit major roadblocks in developing simple solutions to simple problems because a lawyer or auditor shows up and throws a Sarbox fit.

what is the cost of Sarbanes-Oxley compliance to the company in dollars ?

batbomb 11y ago

the salaries of a good CFO and a few lawyers.

phamilton 11y ago
As an engineer at a company recently acquired by a public company, we had a decent amount of work to do to become compliant. Code review, deploy procedure, etc all needed to be documented and formalized. These weren't too difficult, but they definitely tied up engineering resources for a decent amount of time.
- batbomb 11y ago
  Yeah, my impression is that if you are a decently organized company it's a piece of cake. If you have mountains of technical debt, spaghetti code and no build processes, dozens of SaaS products, zero documentation, piecemeal authentication/security, etc... it can becomes quite onerous.
  - phamilton 11y ago
    For us it was a lot of simple things. Change management was the biggest pain but in the end it was just an extra step in our build process. Our canary process was a bit hands on (find a host, deploy to that host, tcpdump/check logs to validate the changes were correct and in effect). We stopped doing that. I can't decide if we are building better software without that as a crutch or if we are just not seeing production issues. Anyway, it's stuff like that. Little shortcuts here and there. Nothing major, but it required behavioral change within the org.

phkahler 11y ago

I'd prefer the cost in humans. How much staff does it take to ensure compliance. That's helps you figure out what size the company has to be since you might have to hire a few people. For a 500 person company it's no big deal. How big was Cruise when GM went to buy them? I think too small to have done an IPO and part of that is that they were too small to have hired the extra people for compliance.

nopzor 11y ago

It costs few million dollars a year just to be a public company, SOX compliance included.

saosebastiao 11y ago

There's an accounting cost, but it's the tip of the iceberg. The real costs add up when even entry level employees (like myself working for a Fortune 500 out of college) hit major roadblocks in developing simple solutions to simple problems because a lawyer or auditor shows up and throws a Sarbox fit.