Eight years after Sarbanes

FierceCompliance.com recently ran a story saying the GRC Market was born eight years ago with the passage of the Sarbanes-Oxley Act -- known as the “Public Company Accounting Reform and Investor Protection Act” in the Senate and “Corporate and Auditing Accountability and Responsibility Act” in the House – which came as a result of the accounting scandals of the day, like Enron, Tyco Corporation, Adelphia and WorldCom, the article says.

So, eight years after the passing of the Sarbanes-Oxley (SOX), how has the GRC Market matured, what is its current size, and what sort of GRC software decisions do CFOs face?

The E-Commerce Times reports that “a post-SOX syndrome appears to be setting in” among GRC players, and the market may be reaching its cap at $33.5 billion, according to AMR Research. Another study by the Open Compliance and Ethics Group (OCEG), a nonprofit organization that set industry-wide GRC guidelines and standards that polled 570 public and private entities, finds 21 percent had no plans for GRC spending in 2009.

Less than half of the polled companies said they would spend less than $100,000 on GRC, with just 12 percent investing more than $500,000, the OCEG report finds.

Some industry observers say as companies become more SOX compliant, IT spending on GRC will slow to a crawl. A BNET Technology article says, “Vendors themselves suggest that the need to demonstrate clearly, at the corporate, government and non-profit levels, is as acute as ever. Monitoring transactions, monitoring supply chain risk, and managing operational and enterprise risk are all big issues still.”

Another FierceCompliance IT article says selling GRC solutions during the current economic downturn means focusing on risk and compliance, “especially to financial services companies. Selling GRC in tough times might be easier that selling other solutions that may not seem as critical,” the article says.

John Hagerty, vice president of AMR Research, told the E Commerce Times, “There is still a lot of original legal compliance work to be done that will justify GRC spending, but we are also beginning to see some caution with managements looking to determine an ROI before they spend.”

Meanwhile, sort of summing up the last eight years, Forrester Research Analyst Chris McClean said in the E Commerce Times article, “There are a lot of factors behind the growth of GRC, but the most important one was SOX.”