Comments on: Sarbanes-Oxley Insights: An Interview With Bob Hirth of Protiviti

By: The State of Sarbanes-Oxley Compliance According To Protiviti - Francine McKenna - Accounting Watchdog - Forbes

Wed, 06 Jul 2011 16:31:01 +0000

[...] interviewed Protiviti Executive Vice President Bob Hirth in January as they rolled out the survey. fm: Given budget constraints and cost cutting at many [...]

By: re: The Auditors » Blog Archive » The State Of Sarbanes-Oxley Compliance: The Protiviti Survey Results

Sun, 26 Jun 2011 19:17:21 +0000

[...] interviewed Protiviti Executive Vice President Bob Hirth in January as they rolled out the survey. The Protiviti report had a few surprises for me – [...]

By: re: The Auditors » Blog Archive » Auditors and Consulting: Claims Of No Conflict Strain Credibility

Mon, 14 Feb 2011 15:52:14 +0000

[...] one of the first to be put on the prohibited list for a company’s auditors under Sarbanes-Oxley, have more frequently been proposed by the external auditors in the UK. It’s as much the fault of the clients themselves, more focused on cost savings from [...]

By: Francine

Francine — Thu, 11 Feb 2010 15:47:22 +0000

@Alan Whitesmith

Well, the questions were mine. Whether or not they answered them in an original way is something else. I am planning on asking similar questions to other independent service providers and GRC tools/technology providers such as SAP. If any of the Big 4 or next tier firms would like to provide their responses, I will print them, too.

I thought the topic was timely and the information that will come out of encouraging more response to their survey may be useful.

By: Alan Whitesmith

Alan Whitesmith — Thu, 11 Feb 2010 14:56:53 +0000

I am surprised to see this interview on your blog. Seems more like an infomercial. Same stuff you can get off their website.
Alan

By: Norman Marks

Norman Marks — Thu, 28 Jan 2010 23:35:53 +0000

Francine,

Thanks, first, for sharing this interview with my good friend, Bob Hirth. Bob is a gentleman of high integrity, experience, and insight and I have always valued his opinion.

After talking to Bob, you asked Scott this question: “Where do you see the GRC software and testing and process documentation repository software providers from a capability maturity model perspective?” In the context of this discussion, it appears as if you are talking about the audit/assurance/compliance functions related to management’s Sarbanes-Oxley compliance program.

However, GRC is a term with multiple meanings: for some it refers to the way in which an organization directs and manages the organization to advance the interests of its owners (governance), managing risks to achievement (risk), and remaining in compliance with applicable laws and regulations (the compliance part). But, others use GRC to refer only to risk management and related activities; some, including the influential analysts at Gartner, describe it in yet other ways. Then there are adaptations of the term, such eGRC, iGRC, financial GRC, etc.

I discuss this in more detail in several posts at http://normanmarks.wordpress.com/.

I suggest that the answer to the second part of your question to Scott can only be answered once GRC is clearly defined: “Will the big ERP firms dominate or specialized providers who can focus on the required functional expertise?” In other words, if you are talking about the holistic version of GRC, then it is hard to see niche vendors ever addressing more than a few elements. If GRC is limited to risk management or management of the SOX program, then certainly niche vendors can (and have) been significant.

Disclosure: I work for SAP, which has multiple solutions for our customers’ GRC processes – and Protiviti is a valuable SAP partner.