Risk & Compliance

Sarbox or Sarboon?

The silver lining to Sarbanes-Oxley: getting staff focused on better internal controls, say CFOs.
Marie LeoneMay 9, 2003

While the Sarbanes-Oxley Act of 2002 has increased the workload — and hazards — for CFOs, the legislation could also be something of a boon to finance chiefs. How’s that?

For openers, the added compliance risks that CFOs are now shouldering could make them a more valuable commodity in the job market. Indeed, recruiters say finance chief salaries may go up because of Sarbox risk — particularly risks associated with certification of company financials.

Moroever, Sec. 404 of the law requires companies to maintain and monitor their internal controls. Setting up or improving such systems — while a pain in the short-run — may well help some CFOs ratchet up their internal control mechanisms.

Take John Hendrix. The CFO at Cornell Companies, Hendrix says he’s used Sarbox as a springboard to create an internal audit department — something the builder and operator of correctional facilities didn’t have 18 months ago. A mid-size company with 4,000 employees and $280 million in revenues, Cornell has long used integrated financial systems. But Hendrix said the company lacked the documentation and internal reporting flow charts needed to satisfy the new law.

With some prodding by Sec. 404, Cornell’s major processes (payables, receivables, payroll, revenue cycle) are now under continuous review. Any “material weakness in controls — or business and legislative changes that affect controls — is factored in immediately,” notes the CFO.

John Tonsick, managing director at risk consultancy Citigate Global Intelligence and Security, also points out that Sarbox compliance will likely pull many CFOs further into operations. While that may add to a CFO’s stress level, Tonsick, a former corporate finance executive for ARCO and a certified fraud examiner, says understanding operations could help a finance chief better detect fraud. When it comes to smoking out funny numbers, says Tonsick, “all the internal reporting controls in the world cannot make up for knowing what drives profits.”

Of course, getting Sarbox compliance systems in place will drain finance department resources — particularly in the short-run. Steven Schneider, CFO at New York Life Investment Management LLC notes that he’s already earmarked additional resources for the next few months. But six months from now, he believes all the new procedures and processes should be up, running, and monitored, as a matter of course.

Schneider’s broad guess is that his staff will be asked to handle 10 to 15 percent more work over the next half year, but he doesn’t think he’ll have to augment his finance staff, which consists of 30 employees. “The entire [Sarbox risk mitigation] process really helps get the staff focused,” he says. “The certification is really just the final piece.”

Understanding Which ERP Modules Your Business Needs – And When