The role of strategic enterprise risk management and organizational flexibility in easing new regulatory compliance

The impact of new regulatory requirements for internal control reporting on an organization's ability to maintain strategic flexibility has been debated in the popular press extensively. This paper tests theory from strategic management to examine the relationship between an organizations' pre-regulatory strength of strategic enterprise risk management (ERM) processes and their ability to react to new regulatory mandates. In the context of companies' adoption of SOX Section 404 internal control reporting requirements, we examine organizations' pre-SOX ERM processes, ERM supporting technologies, and organizational flexibility in order to better understand the antecedents to the difficulty encountered in meeting SOX 404 requirements. Using responses from 113 Chief Audit Executives (CAEs), we find that organizations with stronger strategic ERM processes and flexible organizational structures already in place incurred little difficulty in implementing SOX 404 mandates. On the other hand, organizations using weaker ERM processes, which focused on control compliance, experienced more difficulty. These findings provide key insights into the importance of strategic ERM in effectively complying with new regulatory controls in volatile environments.

Research highlights
► This study examines organizational factors impacting SOX 404 compliance difficulty.
► Key factors include ERM and a resulting ability to leverage digital capabilities.
► Results support the theory on capability building and entrepreneurial alertness.
► Results show that good ERM processes lessened the costs to meet SOX requirements.
► This suggests alarms over SOX costs generally only applied to firms with poor ERM.