Overall Spending on Governance, Risk Management, and Compliance Will Reach Nearly $30B in 2007 Today, AMR Research released its annual report that stated companies will spend $6.0B in 2007 on Sarbanes-Oxley (SOX) compliance. The report, which looks at spending associated with governance, risk management, and compliance (GRC), found that GRC spending will hit $29.9B in 2007, up 8.5% from last year. On track with our predictions from last year, SOX spending will reach $6.0B again in 2007. AMR Research has been monitoring SOX spending since 2003. After rapid acceleration in initial years, the spending has stabilized at the $6B level since 2005. Though SOX spending only accounts for 20% of overall GRC spending, by 2008 companies will have cumulatively spent $32.3B on SOX. Surprisingly, companies anticipate spending even more for all aspects of SOX compliance in 2008,” said John Hagerty, vice president and research fellow at AMR Research. “What we thought would be a gradual tapering off of expenses appears to be heading in a different direction—at least for next year.” While companies describe their efforts to comply with SOX regulations as painful and expensive, most also begrudgingly admit that SOX has led to some business benefits. In the latest study, 42% of respondents reported that streamlining business processes is the primary benefit of good GRC practices. Risk management is another initiative attracting interest and fueling compliance spending. AMR Research analysts note that the number of inquiries they receive from companies pursuing risk management programs is skyrocketing. The survey results prove that risk programs have moved from concept to practice. In fact, companies report that they will spend $1.9B on operational and other risk programs in 2007. In 2008, spending in this category will accelerate at the fastest pace of any initiative; AMR Research estimates it will grow 5.4% to slightly more than $2B. Overall, the GRC budget increases for 2007 and 2008 demonstrate that GRC is not a temporary project, but rather a systematic change to how companies manage, monitor, and control business activities. For more information about AMR Research’s governance, risk management, and compliance survey, please contact Kevin Reilly at kreilly@amrresearch.com.
| 
