Sarah Johnson, CFO.com | US
March 9, 2007

real issues with small cap firms

The primary benefit of the 404 exercise for small cap firms is identifying the real risks to their business - bringing together the entity level oversight and who can make the risk decisions, business process documentation (often for the first time) and how the IT function really controls business operation. Senior management often has no idea how IT is running or how it should be managed. Without this opportunity for whole firm oversight and the ensuing discussions for improvements, the business is just waiting for a catastrophe to happen. Fraud, hackers, operations interruptions are just the front line disasters. Add to this the responsibility of management to the shareholders, how can a management team pass up this opportunity?
After managing 2 complete 404 projects, one for a medium sized public company and one for a responsible small cap firm, it is amazing to me how this process actually allowed the business systems users (staff) to communicate to management about how the systems (manual and IT) were working or not and how to fix them. Creative discussions about issues (gaps) and how to make them work better in the business.
It is all the rage to speak about how the oversight costs are unapproachable for the small firms. Much has been learned in the last 3 years about the process, the oversight and the cost of audits.
Planning and communication can reduce the costs of the project to a level everyone can manage.
Methodologies like RCSA (risk and control self assessment) can build internal control in to the daily operations of each department.
As an investor in the US capital markets, I will not invest in a firm that does not have a documented internal control and oversight process in place.
As we have seen time and time again - accountability for performance needs to be throughout the organization and SOX is a great way to start.

Posted by thomas wickes | Mar 10, 2007 11:16 AM ET