How Valneva gave its SOX program a shot of efficiency

As a specialty vaccine company, Valneva develops, manufactures, and commercializes prophylactic vaccines for infectious diseases addressing unmet medical needs, including Lyme disease and Zika. Operating across Europe and North America, the company's SOX and internal controls compliance team oversees controls across multiple legal entities.

With Valneva moving deeper into SOX compliance after becoming publicly listed in the U.S., documenting controls became just as important as designing them. Every control change had to be recorded, every revision traceable, and every update available for external auditors. The team needed an efficient way to maintain a history of control changes across the organization.

The challenge: Managing controls across multiple entities and hundreds of spreadsheets

Valneva managed its control environment manually in Excel, maintaining separate control documentation for each entity. Every design update meant documenting the change, coordinating updates across entities, and preserving a complete audit history. As the number of changes increased, so did the amount of manual work required.

“We used Excel to monitor each entity and had hundreds of Excel files. With our multi-entity framework, trying to monitor changes to the design of controls in Excel was almost impossible,” says Krista Moller, SOX & Internal Controls Compliance Manager at Valneva. “Every time you made a design change in a control, you had to document and show that in your Excel files.”

As a dual-listed company on Euronext and Nasdaq, Valneva's growing SOX compliance program brought new documentation and audit requirements. External auditors weren't just reviewing the current version of a control. They wanted the full history of every design change, when it was made, and evidence that it had been properly tracked. Maintaining that audit trail was time-consuming and labor-intensive, increasing the risk that information could be missed or lost.

“We were moving into a SOX framework, which required a lot more monitoring and external validation of our controls. We knew we needed a system to track all of our changes because external auditors want to know every change you make to every control,” says Moller. “If you're tracking that in Excel, it's very easy to lose all of that data.”

The solution: Making every control change traceable with Optro

When Valneva began evaluating internal controls platforms, the team wanted a more efficient way to manage controls across multiple entities, track changes to controls, and maintain the audit history required for SOX compliance.

“There were obviously a lot of factors we considered, but the primary drivers were efficiency and streamlining,” says Moller. “We wanted controls across multiple entities to be consistent and harmonized. An audit log was also really critical because we needed to track every change throughout the audit cycle.”

Optro's AI-powered GRC Intelligence platform met those requirements, and Valneva implemented Controls Management and RiskOversight. The implementation was completed without external consultants, with Optro's training and support team providing guidance throughout. “The implementation was a very quick process for us. It took only about a quarter, and we didn't have to use any external services,” says Moller. “We leveraged the Optro training and support team. They showed us different templates, helped us set up the framework, and made the whole process quite easy.”

The team now relies on several capabilities across the platform to manage its SOX program, including:

• Audit log: Creates an exportable history of all control revisions for internal and external auditors, replacing manual spreadsheet tracking.
• Workstreams: Gives control owners direct responsibility for reviewing controls and uploading evidence, reducing the time spent gathering audit evidence.
• Benchmarking: Uses an annual questionnaire to identify design changes, reducing walkthroughs when controls haven't changed.
• Prepared by client (PBC): Allows internal audit to request evidence and complete testing directly in the platform instead of relying on email exchanges and shared files.

With its SOX framework established in Optro, Valneva is now expanding its use of the platform. The team is extending the same controls framework to ESG and exploring AI capabilities to help generate control descriptions and automate parts of control testing. When asked about the future of AI in controls management, Moller says, “We're still learning how to leverage AI to develop our control framework. We're excited to discover how we can use Optro for more SOX automation, like generating control descriptions.”

Results: Valneva’s internal estimate is that audit work decreased by 30-40% after replacing hundreds of spreadsheets

Replacing hundreds of spreadsheets with a centralized controls platform reduced the manual effort required to manage Valneva's SOX program. “We’ve had an internal estimate of about 30 to 40% reduction in time spent getting the audit evidence,” says Moller. “The evidence is already in the system, we're connecting with our control owners more regularly, and internal audit performs its testing there as well. It's become a really integrated system we use across the business.”

The team attributes those improvements to internally estimated gains across several parts of the audit process:

• 20-30% reduction in time spent managing and tracking control changes through Audit Log
• 30-40% reduction in time spent gathering audit evidence through WorkStreams
• 20-30% reduction in audit walkthroughs through Benchmarking

Optro has also strengthened collaboration between the SOX team and control owners across the business. Control owners now review controls, upload evidence, and certify their work directly in the platform, while internal audit requests and tests evidence in the same place instead of relying on email. "Optro has helped us connect more with our control owners across the business,” says Moller. “It helps them understand why we have a controls framework and the compliance requirements behind it. They're regularly reviewing controls and certifying things in the system, so they have a much better understanding of why we do what we do.”

The centralized framework has also made it easier to identify gaps across the organization's control environment. “Using Optro really helps us see where our risks lie and where we might not be covering them,” says Moller. “It's hard to identify gaps when you're manually doing this across multiple Excel files managed by different people. Now we can see our risk environment, we can see our controls, and it all maps together.”

That visibility, combined with less manual work, has allowed the team to focus more on risk than administration. “Optro's impact is just general efficiency across the board for our company,” says Moller. “It saves a lot of time for our team so that we can focus more on where the risks are and how we address risk instead of the manual labor of updating small things.”

Spend less time managing controls with Optro

Give your team a connected risk platform that cuts manual work, supports audit-ready compliance, and creates more time to focus on managing risk.

See how Optro can help you simplify controls management

Schedule a demo