Risk Management

Managing the Risks of Sarbox 409

Although the perils involved in real-time financial reporting stack up as formidable, few companies are up to tackling them, compliance experts say.
David KatzJune 10, 2004

Even as it spawns new risks for their corporations, the pressures imposed by real-time reporting under the dictates of Section 409 of the Sarbanes-Oxley Act can add to the legal liabilities of finance chiefs and their bosses.

Under that section, companies must disclose the facts about financially significant events “on a rapid and current basis.” At the same time, as part of the Section 302 certification of financials by CFOs and CEOs, the executives must attest that they’ve installed adequate disclosure controls. But if the company files an 8-K late, “is that a sign that their disclosure controls are ineffective?” asks Spirgel. Tardiness might make investors question a company’s competence in getting material information up to the C-suite swiftly enough he explains — and lawsuits against officers and directors as well as the company itself might follow. (See “The Reality of Real-Time Reporting” for full coverage of the effects of the new Sarbox 409 rules. The rules go into effect August 23.)

Yet while the risks of Section 409 could be formidable, few companies are up to snuff in managing them, say compliance experts. The main reason for the lag is that their compliance focus has been on Section 404, which compels CFOs and CEOs to sign off on the adequacy of internal finance controls. Further, companies are in the midst of phasing in speeded-up periodic reporting strictures: By the end of 2005, companies will have only 60 days beyond the end of their fiscal year to file their 10-K, compared with 90 days in 2002. “Most organizations right now are concentrating on 404,” says Anne Swaller, practice director of Parson Consulting, “so there’s been a little neglect, quite frankly, of 409 and accelerated reporting dates.”

What can executives do to manage the risk of being caught by surprise by the risks of real-time reporting? The most obvious step might simply be to file late and take the time to make the needed adjustments. While late filing might spur doubts about a company’s disclosure controls, the downside of filing an inaccurate 8-K could be much worse, according to Larry Spirgel, an attorney with Morrison and Foerster LLP.

Under a safe-harbor provision in the new rules, in fact, the SEC gives late filers a bye until the end of their current reporting period. In an earlier commission proposal, seasoned issuers of stocks and bonds would have had to file an S-1 form — a long form normally used by first-time issuers — if they came in with a late 8-K. “If you used an S-1 every time you had material information, you would have to stop selling and amend the registration,” adds Spirgel. “It would have made trading in public markets very difficult.” Under the new rules, a late filing won’t cost a company its eligibility to file an S-2 or S-3 short form when it raises capital. In contrast, there’s no protection for incorrect reporting.

To avoid problems with real-time reporting, some executives are taking a longer-range approach. Scanning data generated by their operating units, they hope to uncover brewing material problems early in the game. Each morning at software provider Cognos, for example, CFO Tom Manley pores over “a rich array of report cards,” including current information about software deals that have been closed or changed in the last 24 hours or ones that have been pushed to a later quarter. The finance chief feels that the data provides him with an excellent resource for tackling 409-related risks. “If I had several large deals fall out of a quarter, that could create a potential material event,” he says.

Some executives feel that investments in technology, too, can go a long way toward helping their companies comply with the dictates of current financial reporting. Even as it attempts to emerge from bankruptcy, Owens Corning will be installing a business-performance-management system over the next few years, according to corporate finance director Kent Wegener. A data-warehouse system (with software provided by Kalido) has already been installed, although providers for the data-forecasting and data-presentation functions have yet to be chosen.

Until the system is in place, the company plans to comply with Section 409 through a “manual, brute-force kind of effort,” says Wegener. But once it’s up and running, he expects Owens Corning’s finance executives to have a much clearer and more current view of the company’s risks. “Today, if we have an operating issue in a business, it would go through several layers of management and analytical cycles before it reached the top layer of the company. But because of technology, it would be available at the same time at the top level as lower management,” he says. “It would compress that cycle dramatically.”