How has Sarbanes-Oxley helped companies better understand the risks and complexity that arise from partnerships?

Wagner: Companies may rely on an outsourced service provider to manage payroll, warehousing or other critical activities, and those third parties are also providing financial information. A company's internal controls extend to those third parties; they have a responsibility not only to evaluate the controls under their own roof but also to assess the controls of that third party. Sarbanes-Oxley shined a bright light on these relationships and found [that] many companies misunderstood the extent to which they are responsible for these extended controls.

Dittmar: In IT outsourcing, the need for controls is a game changer. It has to be explicitly addressed in service-level agreements. It's leading to pressure, because if you ask an outsourcer to do more, they want to charge you for it. The book is far from closed on this.

How has Sarbanes-Oxley compliance led to processes to minimize human error?

Wagner: In most companies, the preponderance of controls is performed manually. If you are able to take the human factor out, the risk of problems with controls greatly decreases. Automated controls are not subject to fatigue, absenteeism or distraction. But opportunities exist in many ERP systems for many automated controls that were never activated. Many organizations are having a second look at that and looking at the whole internal control program to see where they can automate.