We have some experience in that regard. Some of you may recall the time and attention that management of US banks devoted to section 112 of the Federal Deposit Insurance Corporation Improvement Act, which first required bank management reports on internal controls and auditor attestations in the early 1990s.
Then the process became routine, delegated to lower levels of management and unresponsive to changes in the way the business was being run. Unfortunately, for organizations with weak governance, trying to change the culture again to meet Sarbanes-Oxley requirements is taking an exceptional amount of senior management and directors’ time - time taken away from building the business.