Qualys Inc. Modernizes SOX Compliance & Improves the Annual Audit with FloQast

Qualys was founded in 1999 and provides cloud computing security and compliance solutions. Today, Qualys and its 15 subsidiaries serve nearly 16,000 global businesses — including over 70% of Forbes Global 50 companies — in more than 130 countries. According to its website, Qualys helps businesses by automating “auditing, compliance, and protection for IT systems.”

As a multinational, publicly-traded company, efficiency in closing the books and SOX compliance are crucial for Qualys. Those are a few of the reasons Qualys decided it needed an accounting workflow automation software in 2019. Managing the month-end close via spreadsheets was no longer sustainable.

“The spreadsheet served its purpose,” recalled Valerie Cardozo, Director of Finance and Compliance at Qualys. “But it wasn’t efficient. As the company grew and the close schedule became more complex and time-sensitive, we found the spreadsheet was not working optimally.”

The Qualys accounting team is spread out on opposite sides of the world, which also presented some unique challenges. While Qualys’ headquarters in the U.S. handles the U.S. books and consolidation, the close process for Qualys’ international subsidiaries is managed by the company’s office in India. That made checking on the close status a bit of a challenge.

An Implementation Timeline That Works

After researching potential solutions, Qualys narrowed the field to two finalists.

Cardozo asked her team for feedback after assessing both FloQast and Blackline. The implementation timeline and cost also gave FloQast the edge. “It came down to BlackLine and FloQast, and I felt FloQast was more flexible and able to manage our needs as a global team.” Valerie Cardozo, Director of Finance and Compliance at Qualys.

“It came down to BlackLine and FloQast, and I felt FloQast was more flexible and able to manage our needs as a global team,” Cardozo said.

With FloQast’s streamlined close checklist, the teams in the U.S. and India have more visibility into the close process.

“It gives everyone a bird’s-eye view to see what tasks are open on a daily basis,” Cardozo said.

Qualys also started using FloQast Variance Analysis to perform a monthly flux analysis on the income statements and balance sheets of its larger subsidiaries. Before implementing FloQast, the team pulled the data from NetSuite, downloaded it into Excel, manually inputted formulas for the variance analysis, etc.

“That was challenging,” Cardozo said. “There’s always the possibility of a mathematical or formula error. Plus, if we changed the numbers, we had to refresh the data and do several steps again.”

Now, they’re able to quickly identify and address areas that need attention.

“We are aware of open items and can assess quickly if there is a change in deliverables by management. It gives better visibility, as opposed to a spreadsheet which only a few people had access to.”

“We’re a global company, so if I want to find out what’s causing a variance in the France subsidiary, I can easily go into the flux analysis, and find the explanation. The data is readily available and in one place,” Cardozo said.

A Modern Approach to SOX Compliance

After seeing how well FloQast worked for the operational side of things, the Qualys team decided to use FloQast’s accounting workflow automation tools for SOX compliance as well.

“We’ve taken all our manual controls that were in the risk control matrix and moved them into a subsidiary called ‘FloQast SOX,’” Cardozo said. “Now, instead of me looking at Excel or sending out reminders, I’ve assigned the controls to the designated team member.”

Reflecting on the shift, Cardozo said it’s a much better way to organize the SOX compliance.

“It gives better visibility in terms of who owns the control because sometimes several people have a piece of the control,” Cardozo said. “For example, if we have a treasury control, the senior accountant does one part, the accounting manager another, and the treasurer signs off.

“I’m in charge of SOX, and FloQast gives me peace of mind knowing controls are signed off and the evidence and data is readily available.”

Improving the Audit

Qualys also gave auditor licenses to both its internal and external auditors, which allows the auditors to look at the reviews, reconciliations, and analysis that support the sign-offs. So far, it’s been a time-saver for the Qualys team, and it’s helped improve the audit for both teams.

“All of the auditors embraced FloQast,” Cardozo said. “I think they have realized that at the quarter-end our team has multiple priorities, both with the internal reporting requirements, and the auditors PBC list. By giving the auditors the license, they can get information as needed.”

When asked how she and the organization would function if, hypothetically, FloQast suddenly didn’t exist, Cardozo said she would be crushed.

“I would be devastated,” Cardozo said. “We would have to completely re-engineer how we operate on a position-by-position basis, where and how the data is being stored. I’m not sure we could ever go back to closing the books the way we did before FloQast.”