Wendy's Streamlines SOX Controls and Audits with Workiva's Integrated Risk Solutions

Famous for its square hamburgers and Frosty® treats, Wendy’s® pours in nearly $1.9 billion in revenue annually. Melissa Clawson is the Chief Audit Executive for Wendy’s. She has approximately 160 business key controls, 16 IT controls, 200 non-key controls, and over 300 franchises under her watch—needless to say, she’s constantly looking for ways to work smarter. 

One of Melissa’s first objectives when she came aboard over four years ago was to perform a comprehensive risk assessment to refresh audit scope and current processes and to re-evaluate key and non-key controls. But internal controls and audit operations were anchored in manual processes and standalone legacy systems—she needed a solution to help her remove the clutter.  

She didn’t have to look far: Wendy’s was already using the Workiva platform for SEC reporting. After discovering the time savings with the platform’s SEC tool, Melissa eventually implemented Workiva’s controls and audit management solutions, which saved her precious administrative time, fine-tuned audits, and opened up a new world of analytics. 

One tool to slay the hydra

Although Melissa had the vision, the workpapers she needed to execute it were tied up in disconnected desktop systems and Office Suite software. 

One file held the entire risk control matrix (RCM), which included all controls and risks, and defined key and non-key controls for any given year. Test programs, which consisted of several other audit program files, were stored in spreadsheets, as was the findings list. Meanwhile, narratives lived in word-processing documents, which were linked to controls. Because all this key data was spread across an unmanageable paper trail, updates to control description weren’t captured everywhere they needed to be—for example, maybe control description was updated in the RCM but not in the narratives.  

Certifying quarterly self-assessments was no different. And reminders to fill out survey questionnaires that went to business and process owners had to be sent manually, requiring ongoing follow-up.  

Collectively, these processes created a fragmented, administrative challenge—only automation could untangle the snarls. 

The tie that binds

Melissa and her team began shopping around for reporting software in a fierce marketplace. But with Wendy’s already using Workiva’s SEC reporting solution and the SEC endorsing Workiva’s platform, Melissa asked for a demo. However, the ERM team recommended a cloud tool it was already using for enterprise risk assessments. 

Above all else, Melissa needed a platform that could automate control description updates across various touchpoints. “Some tools are great about that, like Workiva, and others were not so much when we reviewed them, and that was one of the big selling points for us,” she said. 

Additionally, with the Workiva platform, she could easily make basic updates without relying on IT support, which also ticked off another box. The platform also offered an easy onboarding experience for her team. 

Ultimately, she landed on Workiva because of its intuitive functionality. “We chose Workiva for the ease of use. We loved the automatic updating. You had the control link to the narratives and so you update it once and it's pushed everywhere,” she said. 

Ramping up to the automation highway

After securing the right tool, she then began assembling the jigsaw puzzle in front of her. She synced up with a designated Workiva support specialist to begin COSO mapping and drilling into the specific SOX templates she required, as well as formatting documentation and establishing permissioning and tracking controls. Workiva’s customer support then uploaded her requests into the system to match her team’s working environment. 

Melissa said the timeline for SOX implementation took two to three months end-to-end. “And it wasn’t two to three months of full capacity either. You might have a couple of hours a week because it was a great partnership working with Workiva, and there would oftentimes we didn’t need to do anything, so it was pretty seamless, and it wasn't that much of a lift,” she said. 

Keeping Wendy’s SOX on

With SOX controls now fully scoped, tightened, and automated, Melissa currently uses Workiva’s features for the entire audit testing process. 

Updates to control description no longer involve a tangle of spreadsheets and word-processing documents. With a keystroke, rewording is instantly processed across all audit workpapers. She also uses Workiva’s linking feature during walkthroughs with management. “We can update the control wording and then it's pushed through everywhere. We don't have to worry about the administrative burden of updating several areas, and it's nice that management can own the narrative, and it's automatically updated,” she said. 

Melissa utilizes the certification tool, which features automatic roll forwards quarter to quarter, and she can set automatic reminders to review controls and other documents. With dashboard reporting, Melissa and leadership can track whether controls are open, closed, in review, in progress, or not started for SOX interim and year-end testing. 

One thing leads to another

At this point in Melissa’s journey with Workiva, the missing connection was to optimize audit operations. She looked under the hood at Workiva’s audit management solution—and fast forward—implementation is inching closer to completion. The roll-out will debut Wendy’s first operational audit in the cloud. 

Melissa intends to harness Workiva’s analytics with the enterprise audit for further issue tracking and sub-risk assessments and with franchise audits. She and her team had been using audit command language (ACL) for analyses. But Wendy’s audit files are massive, and with teams working from home over VPN, analytics took longer than expected. Adding to the setback, the key ACL expert moved to another part of the company, making employee upskilling more difficult. 

Melissa is currently using Workiva’s audit analytics to finalize automation of the restaurant chain’s franchise audits. “Workiva has a great out-of-the-box startup. We will leverage some of those analytics to automate more and change how we're doing it,” she said. Once further traction is gained, she intends to use these scripts for continuous monitoring. 

Simultaneously, her team is migrating from Oracle on-premise to its cloud ERP. Once this transition is completed, she intends to automate more testing in the future for additional coherence and data insights.

Getting granular 

Melissa is expanding her scope into more targeted controls testing and franchise audits after increasing capacity through Workiva. Because the Workiva platform has saved Melissa time on manual processes, she can now run additional operational assessments and advisory projects, providing further actionable insights for the organization and audit committee. 

The upshot

Not only has Melissa and her team benefited from Workiva’s platform, but other internal stakeholders have as well, including the SEC reporting team. Since it doesn’t have a prepared by client (PBC) list or a document request portal for convenient document submissions, Melissa and her team allowed the SEC team to use the functionality in the SOX module so they can easily copy requests quarter to quarter and automate follow-ups they can leverage for financial report creation. 

Also, Workiva has been excellent for any reliance or re-performance of control testing for external auditors because they can view live status updates. “They can see the status and they know when it's complete. That means it's been through all of our review, and they can go in and directly pull and save all the documentation,” Melissa said.

What has been most impactful for Melissa throughout her voyage with Workiva? “There seems to be a constant evolution of enhancements Workiva is rolling out,” she said. “It’s been a nice saving grace to cut down on admin time.”

The Wendy's name, design and logo, and Frosty are registered trademarks of Quality Is Our Recipe, LLC. 

Office is a registered trademark of the Microsoft group of companies in the United States and/or other countries. 

Oracle is a registered trademark of Oracle and/or its affiliates.