SarbOx Sustainability

Raleigh, NC

This installment of our series on SOX Sustainability concerns the “Testing and Validation”.  In Part 1, we introduced this as a significant SOX sustainability challenge.  Other installments have (will) address the remaining challenges and provide a series wrap-up.

 Testing and Validation

The saying “what gets measured gets done” may be re-worded as “What gets measured and validated gets proven.”  Without embedded testing, validation and feedback systems, compliance projects are seldom optimized.  The compliance initiatives fall prey to assumed performance, assumed results and subjective evaluations that don’t properly attribute results and roadblocks where they belong.  Without testing or validation, compliance initiatives lack the teeth to prove that compliance is accomplished and goals achieved.

For sustainability initiatives, testing and validation measures must be designed to outlive the ‘compliance project.’  That is, testing and feedback systems must be incorporated into the business processes that will sustain the enterprise.  At least three different types of indicators and measures should be instituted with the sustainability program.

1. Measures and indicators regarding the status and effectiveness of the sustainability “project”
2. Measures and indicators regarding fundamental business performance that illustrate improvements in daily processes
3. Compliance indicators and measures to track the testing and effectiveness of internal controls to underpin the §404 management assessment

It will require all three of these to manage the initiative, the efficiency goals of the initiative, and satisfy the internal control objectives underlying the initiative.  Metrics will take the form of status indicators, KPIs, KCIs, and anything that the enterprise (and management) deems important to manage the business.

Business Performance Management (BPM) is an integral part of Sustainability initiatives.  This is because improved business performance must be the goal of the program, with compliance derived as a byproduct of effective business process.

Enterprises with existing BPM systems and metrics can probably continue to use their existing systems and metrics.  Introduction of the sustainability initiative will probably require supplemental measures and indicators to what the enterprise is currently using, but many or all of the current indicators and metrics should be preserved as the enterprise is used to using them.  The additional tests and validation measures are tied to the goals of the sustainability initiative, and what the organization wants to achieve through the initiative.

Sustainability initiatives typically require from 12 to 24 months to fully implement.  Accordingly, it is important to establish metrics and measurements that capture legitimate progress and improvements beginning almost immediately.  This is necessary to reinforce management and organizational commitment to see the initiative through to completion.  Tangible results and data will also be necessary to overcome nay-sayers and doubters who will otherwise obstruct progress for personal reasons.  Metrics and indicators that will track program progress and report early results should be agreed and defined very early in the sustainability project so that they can be captured and reported almost from day one.  Metrics that relate to the performance of re-engineered and optimized processes, etc. may be defined and implemented as and when appropriate.

To track and report progress it may be helpful to establish and communicate “current” performance benchmarks that represent current or recent performance results, and against which future improvements will be measured.  Sustainability initiatives should not be launched without pre-established benchmarks and goals against which tangible progress may be reported.  Without such “lines in the sand” there is too much speculation and subjectivity in evaluating results.  It will be too easy to shortchange the initiative fearing that it is not achieving the desired goals.

Companies would also do well to establish cost tracking and cost saving metrics to capture sustainability initiative costs (outsourced and internal) against the savings attributed to improved process and efficiencies.  Baseline cost benchmarks should not be tied solely to pre-SOX operating cost structures, but should include cost measurements or estimates of the additional compliance burdens imposed by SOX, so that the sustainability initiative is properly comparing end results against a meaningful, starting benchmark.  Presumably without the sustainability initiative the enterprise will incur the compliance costs on an annualized basis going forward as SOX is not an optional cost area.

Measures and metrics must also be designed in view of the existing (and future) I/T infrastructure.  A wonderfully conceived metric is useless if the necessary information is not readily available (today) from one database or another.  However, companies are advised not to merely settle for metrics that can be readily supported by today’s infrastructure.  The sustainability initiative should consider and target certain key metrics for reporting and evaluation based on today’s capabilities and identify metrics that represent where the enterprise needs to go.  Future-based metrics should necessarily consider corporate goals and expected changes in culture-process-technology that will occur over the ensuing 12-24 months.

This approach is in keeping with the spirit of the COSO Internal Control and ERM frameworks, not just the letter of them.  Both frameworks call for goal (or objective setting) to establish enterprise direction.  Risks are then defined in context of the established goals, and risk responses and control activities implemented to address the risks.  Reporting systems should be conceived to help support the achievement of established goals (objectives). 

To review earlier articles in the series please visit Visage’s website at the URL below.

VisageSolutions is a group of experienced operational executives focused on providing efficient, repeatable complinace (including Sarbanes-Oxley) solutions. By working carefully with their clients VisageSolutions provides customized solutions that focus on reducing the “operational cost” of sustained compliance through an optimum combination of existing and new technologies and tools, and business process integration.  See www.visagesolutions.com for more information and related links.