VideoMost companies are anxious for business unit managers to assume accountability for Sarbanes-Oxley compliance. Yet, they also realize that the biggest pain points in the compliance process — and the biggest opportunities for achieving savings and greater efficiency — lie not in the scramble for better documentation that they focused on in year one, but rather in fundamental areas of financial reporting such as testing, monitoring, and remediation or mitigation.
That's where automation comes in. At Transaction Systems Architects, which develops E-payment software for companies, vice president of financial planning analysis David Konz says responsibility for process documentation, testing, and any remediation or enhancement activities resides with the process owners. Business processes and controls, supporting functions such as accounts payable, accounts receivable, receipt and setup of contracts — TSA is seeking to automate and standardize all of these functions across the organization.
"Only automate in such a way that would enhance and add to the existing control structure," Konz advises. A survey of 180 finance executives by CFO Research Services (a sister organization to CFO.com) found that automating the compliance and control environment is a priority for 76 percent of companies. Those with over $1 billion in annual revenues, which typically have more complicated or geographically diverse organizations, rank it even higher. Similarly, 51 percent of all respondents say they would prefer to leverage automated controls with their ERP systems rather than streamline their manual controls, while the margin jumps to 56 percent for respondents who consider automation of compliance and controls to be a top-priority item over the next 12 months.
Going forward, most executives predict that automation will be essential to establishing a sustainable Sarbanes compliance framework. Manual processes that require the involvement of employees, consultants, or auditors are not sustainable. Automation of documentation, monitoring, testing, and enforcement are more stable and coherent than in the days when E-mail and Excel spreadsheets and sampling testing were managers' and finance executives' main methods of managing compliance. That's in large part because they enable a repeatable, reliable, and predictable solution, while significantly lowering the cost of compliance.
Some companies, in fact, say that Sarbanes has been a catalyst for automation, pushing them to make changes sooner than they'd originally planned. At Olympic Health Management Systems, CFO Dick Warren says the control assessment tool that its corporate parent, Aon, put in place in response to Sarbanes to track required documents "has been a huge benefit from a corporate standpoint because it enables centralized review and control — from the ultimate SOX standpoint — all the way up to the chairman and CFO of Aon."
Additionally, conversations with executives suggest that foreign companies are more anxious to push ahead with automated compliance. That's because foreign issuers are not required to comply with Sarbanes until the end of 2006, giving them more time to put a definitive system into place while at the same time preparing to embark on their first year under the statute. ABB, the European power and automation technology company, is developing an internal tool and is also investigating online training programs, says Nadine Troccoli, leader of the company's Sarbanes-Oxley effort.
Companies have different expectations for what they believe will be the most important uses of their new automated systems, however. Almost half of all companies in the survey — and over half of those with more than $1 billion in annual revenue — state that security and access controls are areas they currently automate or plan to automate in the future. Thus, security is the one area on which companies show the most agreement.
Some companies also place a great deal of emphasis on developing dashboards that will enable them to extract high-level reports on compliance for top management. Technology consulting company Kanbay International is integrating a reporting tool at the same time that it completes its first year of Sarbanes compliance — largely through manual efforts. By year's end, corporate controller Bruce Fortelka expects it will have this reporting application completely up and running. A top priority, he adds, is "being able to extract high level summary reports from the tool — something that the CFO and CEO can rely on to know that controls are in place, have been tested and reviewed."
Most companies, however, emphasize the importance of automation to them for achieving the greater command and control over data that successful Sarbanes compliance promises. "Through automation, the sites themselves are able to be more efficient operationally, and also the corporate office gains greater understanding of what's going on," says Craig Walczyk, CFO of the real-estate development, investment, and management firm Waterton Associates.
Automation and "Pervasive Compliance"
The biggest long-term gains from automation, however, are to be had by companies that look for ways to embed automated controls throughout their cross-enterprise business processes. Going forward, Warren says he would like to see workflow applications developed that link Aon's automated control assessment tool directly to the actual Sarbanes reporting, control, and testing functions, so that these can themselves generate attestation and other data for the tool. The result would be an environment of pervasive compliance, where as much of Sarbanes and other compliance regimes as possible are fulfilled through enhanced controls located within the business processes themselves.
Reader Comments» Post a comment