Business Process-Based Regulation Compliance: The Case of the Sarbanes-Oxley Act

Balance Sheets and Annual Financial Reports play a major role in determining the public worth of any company. In the wake of corporate scandals such as Enron and WorldCom, the US and other countries passed legislation governing reporting processes. The Sarbanes Oxley Act of 2002 (hereafter SOX) requires US national securities exchange and US national security associations not to list any securities of any issuer that is not in compliance with the act. In this paper, we present a business process-based solution to the SOX compliance problem and offer evidence that such a solution is feasible through an industrial case study. The proposed solution aims to support SOX reporting requirements based on core business processes and a continuous improvement of the company\´s adopted business processes. This means that the solution integrates SOX-related tasks into the "daily work" of a company, rather than achieve compliance on a project basis.