There was a lot of uncertainty and resistance. So, I would say the first several years most of the focus and effort was on compliance,” she said. “Probably three to five years post-enactment, organizations started to settle and get perspective. The tone was changing. Organizations were meeting the minimum needed for compliance and the environment started shifting into areas identified for efficiency and improvement, such as standardizing key processes and controls, reducing complexity, increasing documentation and training, and ensuring an effective control environment. Compliance became the result of that effort, not the driving force.