SarbOx Sustainability

Raleigh, NC

As public corporations complete their first §404 assessments and internal control audits, many are realizing that things need to change in 2005 and 2006.  That is, the processes they employed and documentation they assembled for their first control audit cycle were not efficient, and in some cases, were disruptive to ongoing operations.  One-time accommodations, late hour heroics, and system band-aids might have been required to achieve a passing grade from the auditors for the first internal control audit cycle, but such measures are costly to the organization if repeated each year.  At best such measures are frustrating, at worst, damaging.

 As the §404 assessment and control audits will be repeated each fiscal year going forward, processes, methods and information structures need to be streamlined and revised to achieve efficient, sustainable compliance going forward.  The alternative is to repeat the knee-jerk processes and documentation methods employed over the past year.  Sustainability (of compliance) will be a major issue for many public corporations in 2005 and 2006.  Let us discuss the major factors that will affect sustainability.

 Sustainability is an organization-wide issue.  This means it is a Cultural Issue.  Cultural impediments, personalities, weaknesses, and lack of depth must be considered and/or addressed.  Likewise, relative strengths, talents and newly-discovered capabilities must be integrated.  The VP or Director who impeded or poorly supported the initial compliance effort because he or she didn’t want to look bad must be dealt with by executive management or the Board of Directors in 2005.  Efficient compliance requires commitment from the top all the way down through the organization. 

 Sustainability is a Business Process Issue.  Without solid process with which to execute the business plan, and to derive compliance as a by-product of solid performance, the internal control management and assessment process will always be an afterthought and headache.  But implementing effective processes within an organization requires critical assessment of those processes and methods that the entity can readily assimilate.  And it requires identification of those processes and methods that must be integrated by stretching or changing the organization.

 Sustainability is a Technology Issue.  Capabilities and/or shortcomings in key technology areas either help or hinder performance and efficient execution.  Appropriate technology can help to make weak cultures better able to sustain the necessary compliance overhead.  Appropriate technology can help a strong culture excel.  Software and hardware systems must be evaluated and integrated to reduce interface and inter-working problems and to facilitate control assessments and audits.  Those companies with highly integrated technology systems (including solid ERP systems) certainly found their internal control assessments easier in 2004 than those companies with multiple, disconnected, best-in breed platforms.  Going forward, technology decisions must consider compliance and control integration with existing entity systems as a significant purchasing factor.

 Sustainability is a Management Issue.  Management’s commitment to achieving effective, efficient, sustained compliance is the difference-maker, at all management levels.  If all levels of management are not committed to intrinsic (internal) as well as extrinsic (external) process integration, cultural and technological evolution and integration, then sustainability, per se, will not be optimized.  It will always be an after-thought and an aggravation.  Management commitment is necessary to nudge or pull reluctant cultures toward the next mountain, and to overcome substantial obstacles in the path.  Recalcitrant managers are cultural impediments to growth and evolution.

 Sustainability requires Integration and Coordination.  All departments of the organization must understand what is expected and required of them, and they must understand what other departments are doing.  The Accounting Department must understand what I/T is doing to improve corporate process, and vice versa.  Sales needs to know what software MIS is implementing or developing, and MIS needs to know when Manufacturing is implementing a new vendor certification process.  Treasury Services needs to advise Internal Audit and MIS when it changes providers of electronic funds transfer (EFT) services, notably if a new vendor-furnished software system is part of the change.  And Internal Audit needs to know when internal control processes anywhere in the organizations will change so it can coordinate management assessment and attestation requirements.  Lack of integration and coordination causes duplicate or triplicate work across the entity and may lead to attestation issues.

 Sustainability requires Validation and Testing.  The saying “what gets measured gets done” may be re-worded as “What gets measured and validated gets proven.”  Without embedded testing, validation and feedback systems, compliance projects are seldom optimized.  The compliance initiative(s) fall prey to assumed performance, assumed results and subjective evaluations that don’t properly attribute results and roadblocks where they belong.  Without testing or validation, compliance initiatives lack the teeth to prove that compliance is accomplished.

 Sustainability requires effective Change Management.  All organizations change over time, in culture, process, technology, business focus, etc.  A compliance program that is deployed today without an integrated change management mechanism to review and update the compliance elements over time will be obsolete in 12-18 months.  Unless the compliance initiative is conceived and implemented with a meaningful and well-conceived change management process as an integral part of the construct, the organization will struggle to adapt the compliance systems when/as faced with the need to evolve.

 This article is the first of a series that will discuss sustainability issues for SOX compliance going forward.  Articles will include further discussions on the major factors that effect sustainability mentioned above plus other factors that present themselves as we help our clients build solid repeatable, efficient business processes.

VisageSolutions is a group of experienced operational executives focused on providing efficient, repeatable complinace (including Sarbanes-Oxley) solutions. By working carefully with their clients VisageSolutions provides customized solutions that focus on reducing the “operational cost” of sustained compliance through an optimum combination of existing and new technologies and tools, and business process integration.  See www.visagesolutions.com for more information and related links.