Video
On Deadline
They'd better hurry. Publicly traded companies have barely seven months to get in line with Section 404 of Sarbanes-Oxley.
The specter of that deadline leaves little time for businesses to dig too deeply into data deficiencies—or to automate data tracking. In fact, Todd Naughton, controller at Vernon Hills, Illinois-based bar-code maker Zebra Technologies, says that because of the June 2004 deadline, Zebra has ruled out deploying software programs for the first round of certifications. "It's three to six months just to pick a tool and install it," he claims. "And that's before anybody starts putting data into it."
Instead, executives at scores of companies are manually documenting the policies and procedures intended to safeguard the integrity of their financial data. The documenting includes not only assessing where the data is but also deciding who should have access to it. "For me, the problem is not having too much data," says NCR's Shanks, "but how do we use that data and make that data available to the right people at the right time."
NCR maintains an enterprise data warehouse to help with that large task. For many businesses, however, Sarbox compliance remains a very low-tech affair. Zebra simply gathered 10 to 15 employees in a room with an Excel spreadsheet and went about identifying the company's material risks and the controls to address each risk, says Naughton.
Observers say even low-tech approaches can carry some hazards, however. Former CFO Ressner worries that, for some companies, the documenting process could get out of hand, resulting in data about data. "The over-rotation of this," he conjectures, "is that you could end up with a manual for everything."
Ironically, some of this painstaking documenting could come back to haunt companies. According to attorney Birnbach, creating a paper trail about internal-control procedures before identifying what those procedures are may prove to be a big mistake. "It's not wise to put an open discussion about the assessments of control processes onto paper," she notes. "It's discoverable."
Ironically, some of this painstaking documenting could come back to haunt companies. According to attorney Birnbach, creating a paper trail about internal-control procedures before identifying what those procedures are may prove to be a big mistake. "It's not wise to put an open discussion about the assessments of control processes onto paper," she notes. "It's discoverable."
Wait 'Til Next Year
Faced with stiff penalties for lax internal controls, some businesses will no doubt ignore that warning. Instead, they will start saving every bit of unstructured data in the house. "Companies will start saving all E-mail," predicts Doculabs's Watson. "Unless you're confident in documenting policies and data, you'll have to save it."
What's more, identifying a company's internal controls and key financial processes—a Herculean task—is not a one-off deal. "We'll have to update any change we make in internal controls, or if we install new software," concedes Crown's Thompson. "We'll have to update anything that has implications for our flowcharts or internal processes."
Eventually that will lead many companies down the path of automation. As Watson notes, merely backing up everything won't cut it: "You need auto indexing, and you need rules and parameters for the indexing."
A ray of hope for technology vendors? Possibly. Some finance managers say, yes, they'll likely be more inclined to purchase compliance software in 2004—once they're through with all their documenting, that is. Says Naughton: "I don't want to do this every year."
John Goff is a senior editor at CFO.
White Goods for Data?
When Section 409 of the Sarbanes-Oxley Act of 2002 kicks in for real—in January 2004—many companies will have to report material events to the Securities and Exchange Commission within 48 hours. Meeting the short deadline could prove to be a bear, particularly for businesses that plan to examine financial data to determine if an event qualifies as material.
The snag: data analysis is still anything but real time. Data warehouses, which nowadays house terabytes of information, are rarely updated on a daily basis. What's more, the traditional architecture for warehouses—a patchwork of various drives, servers, and software—is best suited for backward-looking, slow-cooking sorts of analysis. The large amount of data movement in a typical warehouse limits the slice of information that can be accessed in a single search (usually about 1 percent of the available data). To get a fanfold view, users must engage in repeated queries. Says one CEO: "You go back and forth, back and forth."
Appliances to the Rescue
Managers who need to perform ad hoc queries—and need the results now—are generally out of luck. Notes Dan Vesset, a research manager at technology consultancy IDC: "Speed of decision-making, whether we're talking about real time or nearreal time, is still only a goal for most organizations."
Reader Comments» Post a comment