1. Control population
Category% controls# controlsHours/ctrl
ITGCs
Access, change mgmt, ops
18% controls
Manual business-process
Journal review, approvals
40% controls
Automated app controls
System-enforced
13% controls
Key reports & IPE
Reports relied upon
15% controls
Management review
MRCs, judgment-heavy
10% controls
Entity-level
Tone, oversight
5% controls
Total in-scope controls
100%
Typical SOX program: 2 cycles (ToE1 interim + ToE2 rollforward). Add 1 if ToD is in scope.
Share of PBCs that need to be re-requested. Good UX cuts this in half via control-owner self-check.
Hours the 1st LOD spends gathering evidence per hour of testing. Default 1:1.
Testing hours (annual)3,180 hrs
+
PBC collection hours (annual)3,578 hrs
Evidence gathering3,180 hrs
Repeat-PBC rework398 hrs
=
Total baseline hours (annual)6,758 hrs
2. Team & cost per hour
People who will actually use the tool day-to-day.
Loaded cost for internal SOX staff.
Big 4 / boutique audit co-source.
Loaded cost for control owners (1st LOD).
Cost of testing (annual)$699,600
In-house$286,200
Co-sourced$413,400
+
Cost of PBC collection (annual)$357,750
Evidence gathering$318,000
Repeat-PBC rework$39,750
=
Total SOX testing cost (annual)$1,057,350
3. Testing savings
Share of controls supported by the tool.
Quality of AI-generated test results and evidence analysis.
How much reviewer editing the AI-generated work papers need.
Without integration, testers spend time on manual evidence and work paper transfers.
Gross testing savings$313,421
Cost of testing$699,600
× RACM coverage80%
× AI quality70%
× WP quality80%
−
Integration support cost$0
Controls in scope160
× hrs/control0 hrs
× cycles2
× blended rate$220/hr
=
Net testing savings (annual)$313,421
4. PBC collection savings
Control owners upload evidence and get immediate feedback, reducing repeat PBC requests.
PBC collection savings (annual)$22,260
Repeat PBC rework cost$39,750
× RACM coverage80%
× pre-validation reduction70%
5. Cost of implementation
Tool admin, prompt tuning, access management.
Drives ramp-up time and PBC rework reduction.
Internal cost (First year)$14,080
Personnel ramp-up$8,800
Ongoing admin$5,280
+
Vendor cost (First year)$100,000
Subscription$100,000
One-time services$0
=
Total first-year cost$114,080
6. Result
Total annual savings$335,681
Testing savings$313,421
PBC savings$22,260
−
Total first-year cost$114,080
=
Net first-year impact$221,601
Simple payback
4.1 months
On target (4–6 months)
Payback clears the 4–6 month target. Worth building the proper business case.