The Six Things You Absolutely, Positively MUST Do To Make Your Sarbanes-Oxley Headache Go Away

In 168 words and without establishing clear standards, Section 404 of Sarbanes-Oxley requires public companies to:

• Establish and document their internal controls and procedures
• Certify the completeness and quality of these controls
• File an Internal Controls Report
• Have their external auditors attest to the adequacy of the company’s internal control system

If you don’t do these things in an acceptable way, the risk of non-compliance includes:

• Fines and sanctions against your company and a legion of SEC inspectors
• Personal liability for corporate executives

No matter how well intended Congress was in attempting to address corporate fraud, Sarbanes-Oxley creates a huge headache for boards of directors, shareholders and corporate executives. Here are the six steps you need to take to make the headache go away.

1. Review and Evaluate Your Corporate Governance Processes
2. Formally Document all Business and Financial Processes
3. Perform Risk Assessment
4. Implement Changes and/or Remediation Required
5. Perform Testing to Validate
6. Regularly Report Results

1. Overall Process Review and Evaluation

• Review and analyze your primary business processes, assesses your overall control environment and your ability to identify, assess and manage risk while simultaneously executing your operating and strategic business plans.
• Identify the specific organizational control framework in place, including -

  A. Code of Ethics

  B. Policies and Procedures

  C. Governance processes and practices utilized

  D. Degree of oversight by Board of Directors, Audit Committee and Executive Management

• Determine areas where improvement is required and implement required upgrades and enhancements
• Review and analyze each major business process and evaluate operating effectiveness
• Identify key exposures, risk factors and control points · Review all financial control processes utilized for initiating, recording and processing individual transactions
• Determine the need for process improvements and identify specific areas where remediation may be required.
• Determine where improvements in operating efficiency, reliability and transparency can be achieved.
• Identify areas where businesses processes may not yet exist and may be required in the future.
• Ensure that controls are designed to

  A. Support all relevant financial statement assertions and disclosures,

  B. Support all significant financial statement accounts,

  C. Safeguard assets, and

  D. Prevent, identify and detect fraud.

Step 2. Formal Process Documentation

• Document the flow of transactions for each significant business and financial process in the form of flow charts, policy manuals, narrative procedures, etc. providing for in-depth analysis and process validation as well as identification of potential areas of risk, inefficiencies and redundancies.
• The documentation must encompasses the entire process for initiating, recording, processing and reporting individual transactions.

Step 3. Perform Risk Assessment

• Prepare a flexible matrix (or equivalent) that summarizes and maps key areas of potential risk to the financial controls in place to mitigate such risk and the key financial controls in place to meet specific GAAP requirements.

Step 4. Implement Changes and/or Remediation Required

• Identify and implement any required changes and enhancements to internal business and/or financial control processes. Also identify and determine specific tools and technological solutions where applicable.

Step 5. Perform Testing to Validate

• Develop procedures (i.e. test scripts) that provide for regular detail testing of systems and processes to evaluate and validate process effectiveness.
• Perform continuous testing to ensure sustained compliance and conduct regular process review, evaluation and upgrade.
• Perform initial detail testing to ensure that the test objectives are in fact being met.

Step 6. Regularly Report Results

• Develop and implement a process to regularly report the review and testing results to senior management and key stakeholders of the company.

Three Types of Companies – Which Group Are You In?

Sarbanes is not going away and the compliance deadline begins in 2004. Here at CFO Connection, we observe three different responses to the law as we speak with Silicon Valley executives:

1. Head in the Sand. These folks are either oblivious or in denial and they are in for a rude wake-up call, because this law is not something they can ignore.

2. Got It Handled. A few companies have invested the significant time and resources necessary to meet their compliance obligations and it looks like they are in good shape. We acknowledge them, because we know the task is difficult and their proactive approach will benefit shareholders and enhance value.

3. Aware and Worried. This is the biggest category of mid-cap public companies. They know they have four problems and they don’t have a viable solution yet. Those four problems are:

The Four Biggest Problems Every Corporate Executive Has With Sarbanes-Oxley Compliance

Problem #1. Lack of Clarity – Knowing What to Do. We interviewed CEOs, accounting firms, board members, attorneys and venture capitalists and the single biggest concern we heard was, “What exactly does this thing mean and what exactly do I have to do to stay out of trouble?”

Problem #2. Lack of a Plan – Knowing How to Do It. Once your get the requirements of the law figured out, then you run into the challenge of how to get this done without turning Sarbanes compliance into your sole reason for existence.

Problem #3. Lack of Resources – Knowing Who’s Going to Do It. Every company is resource constrained and people are focused on mission critical priorities. Given that Sarbanes is not going away and that the compliance deadline begins in 2004, where are the resources supposed to come from to figure out the answers to the first two problems and then get the work done?

Problem #4. Lack of Expertise – Knowing Who’s Got the Skill to Do It Right. As a corporate executive, not only is your company threatened by Sarbanes, but you are also at serious personal risk if your compliance obligations are botched. At CFO Connection, we are full time financial solutions providers to public companies, with decades of CFO experience. Our conclusion after months of rigorous Sarbanes analysis is that this is not a job for lightweights and that not just anyone can meet the standards set by Sarbanes. It takes seasoned financial professionals that understand the rules and who have the skill to play the game on your team and win. So you can focus on your main objectives: running your business, making money and producing shareholder value.

Introducing CompliancePro™

CompliancePro is a six step process CFO Connection developed in response to these challenges. It delivers three benefits:

• CompliancePro systematically takes your company through the compliance process so you can satisfy your obligations under Sarbanes-Oxley.
• CFO Connection provides the skilled resources to implement the CompliancePro system.
• In the process, we’ll show you how to actually make your company more profitable – because done right, Sarbanes compliant operational processes actually can become a powerful tool for efficiency and marketplace differentiation.

For a more detailed overview of CompliancePro and to see how it could work for you, please send us an email at kcorbin@cfo-connection.com and we’ll send you the detailed program overview with no obligation. Or give us a call at 408-399-8000 to explore how CFO Connection and CompliancePro can help in your specific situation.

To enable you to better understand the benefits and application of our CompliancePro system CFO Connection will prepare at no cost a Risk Assessment Matrix covering your principal revenue stream. The Matrix will evaluate the risks and controls in place to ensure that you are properly allocating and recognizing revenue in accordance with GAAP.