Pulling Up Your SOX. Companies Can Gain from Compliance with U.S. Governance Act. Lisa Fabish Stuart Groves

Transcription

1 by Lisa Fabish Stuart Groves Robert Oushoorn Otto Waterlander Pulling Up Your SOX Companies Can Gain from Compliance with U.S. Governance Act

2 1 Pulling Up Your SOX Companies Can Gain from Compliance with U.S. Governance Act More than 5,000 U.S. companies have filed their returns in compliance with the Sarbanes-Oxley Act (SOX), while non-u.s. companies are now starting the process. Unfortunately, many of these companies have had limited success in achieving any benefits or long-term value from their SOX investment. Companies should adopt a number of strategies and approaches to capture this long-term value and to address the related implementation challenges. The Sarbanes-Oxley Act (SOX) represents a revolution in corporate governance for any public company doing business in the United States, requiring a major investment of time, money, and management focus. When President George W. Bush signed the act into law on July 30, 2002, he said it would introduce the most far-reaching reforms of American business practices since the time of Franklin Delano Roosevelt in effect, it is the most significant change in reporting for publicly traded companies since the securities acts of the early 1930s. Companies are estimated to have spent more than US$20 billion to support compliance with the Act since it became law (see Exhibit 1). More than 5,000 U.S. companies with public floats exceeding $75 million have filed the annual assessments required by SOX. U.S. firms Exhibit 2 Non-U.S. Companies Required to File SOX Assessment Reports Exhibit 1 Annual Sarbanes-Oxley Compliance Spend (US$B) Source: AMR Research Source: SEC 1) Non-U.S. large accelerated filers: Companies with a public float exceeding US$700M 2) Non-U.S. accelerated filers: Companies with a public float between US$70M and US$700M 3) Non-U.S. non-accelerated filers: Companies with a public float less than US$70M

3 2 Exhibit 3 Section 404 Implementation Costs as % of Revenues Source: American Electronics Association (AeA) with smaller floats and non-u.s. companies listed in the United States are now starting to file (see Exhibit 2). Section 404 of the act is the most controversial due to the stringent internal financial control documentation and self-testing requirements, the high implementation costs for both small- and large-cap companies, and the significant responsibility placed on the CEO and CFO to attest to the effectiveness of the company s controls. Small companies with total revenues of US$100 million are paying very high costs implementing Section 404, at approximately 2.5 percent of revenue (see Exhibit 3). Larger firms pay a smaller percentage of revenues, but the absolute total costs are still material. Opportunities to Capture Long-Term Value from SOX 404 Unfortunately, many companies are achieving little or no return on their investment in complying with SOX 404. They say that the additional costs of complying with SOX 404 outweigh the potential benefits from improved financial controls and that their existing controls are adequate and entail no material financial reporting risks. In fact, a survey conducted by Nasdaq and the American Electronics Association found that 34 percent of respondents achieved no benefits from their SOX 404 implementation. For others, the impetus of achieving initial compliance is often lost and the organization eventually retreats to the same old habits. This lack of return on SOX is unacceptable. Prudent shareholders and management boards should ensure that long-term value is achieved from SOX, just as with any normal investment. But some companies have been able to gain long-term value from SOX. Jeffrey Immelt, GE chairman and CEO, states, None of us likes more regulation, but I actually think SOX 404 is helpful we think it is a good investment. These companies have identified both direct and indirect benefits resulting from effective implementation (see Exhibit 4). In terms of direct benefits, companies have been able to obtain tighter financial controls, better disclosure and reporting, improved transparency within the organization, and increased business ownership. Exhibit 4 SOX 404 Long-Term Value In addition, compliance with the act has brought about a number of indirect benefits to some companies, including improved business efficiency and enhanced enterprise risk management. The opportunities to capture long-term value naturally depend on the company s initial compliance challenge. Some required minimal work on their control framework and were able to incorporate the requirements of the act into their existing structures, building from a more solid basis, while others had to make extensive changes to their control framework before they could demonstrate compliance. The latter had to fix a situation that was, in principle, unacceptable. These companies are best placed to capture additional long-term value from their SOX investment. Strategies to Ensure Success For many companies, however, it is not clear how to best capture such long-term value. Many organizations have been focusing money and management attention

4 3 on achieving initial compliance, but have not actively addressed the issue of achieving long-term value from their SOX investment. In our work with clients, we have identified a number of strategies to ensure success: rapid embedding of SOX within the organization; rationalizing the control framework; using SOX as a catalyst for business process standardization; and aligning SOX risks with a broadened enterprise strategic risk management approach (see Exhibit 5). Exhibit 5 Strategies to Capture Long-Term Value from SOX Rapid Embedding: The experience of many U.S. companies highlights the need to rapidly embed SOX within the organization from the start to reduce cost and maintain the SOX momentum past initial compliance. Companies must drive down the costs of ongoing SOX compliance and not fall into the trap of early U.S. filers who witnessed recurring high costs. Successful embedding requires companies to set their vision and objectives at the highest level and enforce them consistently from the top. They should design the most efficient structure possible along with supporting processes and tools, and integrate compliance with SOX 404 into the overall risk management approach of the organization. Compliance should be made rapidly operational by making sure the organization is given the competencies it requires. This in turn demands the rapid assimilation and training of new and transferred employees. Control Framework Rationalization: During the initial stages of SOX 404 compliance, companies frequently identified a large number of controls requiring documentation and testing. Rationalizing the SOX control framework is vital for reducing the costs of compliance with the act. Some companies can expect to achieve a significant reduction in SOX compliance cost through a control rationalization program. This essentially entails introducing fewer but higher-impact controls, focusing on the reduction of risk from the top down and addressing higher-risk stages of the financial statement preparation. Of course, experience gained in previous periods can be used in strengthening the risk assessment process. This approach is very much aligned with the new SEC guidance released in late Business Process Standardization: In some cases, SOX 404 was also used as a catalyst to start or accelerate the standardization of other business processes, at the financial, operational, and company levels (see Exhibit 6). This effort has resulted in a reduced set of more standardized SOX 404 and business controls, which has led to improved business efficiency and compliance costs. Some companies have capitalized on this opportunity to contract with shared-services organizations to carry out business processes while increasing their reliance on information technology. Exhibit 6 SOX 404 as a Catalyst for Standardization Broadened Risk Management Approach: Similarly, many firms have used the SOX effort as a vehicle to launch improved risk management across the enterprise. Placing controls on financial reporting risks in the context of the broader set of risks facing the company can be a strong first step in adopting a broadened strategic risk management framework (see Exhibit 7). Many companies have used the momentum behind SOX compliance to make risk management part of the core decision-making approach and culture across the organization.

5 4 Exhibit 7 Strategic View of Risk Shell is an excellent example of a large multinational that has focused on rationalizing the control framework, while simultaneously standardizing business processes. Peter Voser, chief financial officer of Royal Dutch Shell PLC, said Sarbanes-Oxley compliance had proved a catalyst for change and lever against inertia. Shell, which operates in more than 100 countries, has traditionally allowed local management to retain strong control of business operations and processes. Because of this diversity, the company initially identified more than 50,000 controls that would need to be documented, tested, and assessed for compliance with Section 404. By standardizing processes across the company, implementing global IT systems and outsourcing common processes to shared-services organizations, Shell was able to reduce the number of controls to 13,000. According to Voser, Shell is now seeking to continue this effort of standardization and simplification by bringing the number of controls down to 5,000. Implementation Challenges and Approaches When implementing the SOX long-term value strategies, companies have faced a number of challenges that can be effectively addressed through specific approaches (see Exhibit 8). There is often a slow handover of compliance activities from project teams to an embedded organization. In these cases, compliance frequently moves from a high-priority strategic activity to a lower level of importance. In addition, communication is often not clear and changes are not effectively managed, leading to behavior that does not promote long-term compliance. Exhibit 8 Implementation Challenges and Approaches

6 5 To counteract such behavior, the embedding effort therefore must focus on changing the culture of compliance within the organization. It is also a fact that compliance efforts get off track because of limited contingency planning to address the uncertain and evolving methodology to comply with the act. And because of the high demand for experts and auditors knowledgeable about the act, companies often face significant difficulties attracting and retaining key staff with the required expertise. Conclusion Companies can capture significant long-term value from their SOX investment, such as tighter financial controls, better disclosure and reporting, improved transparency and business efficiency, increased business ownership, and enhanced enterprise strategic risk management. However, they must not fall into the trap of many of the early U.S. filers who failed to obtain benefits from their significant SOX investments. Through our work with clients, we have identified strategies for companies to capture this value and have developed approaches to address the related implementation challenges. Recent non-u.s. filers are well advised to review their current SOX activities to ensure they are adopting these strategies and approaches throughout their organizations. What Booz Allen Brings Booz Allen Hamilton has been at the forefront of management consulting for businesses and governments for more than 90 years. Providing consulting services in strategy, operations, organization and change, and information technology, Booz Allen is the one firm that helps clients solve their toughest problems, working by their side to help them achieve their missions. Booz Allen is committed to delivering results that endure. With 19,000 employees on six continents, the firm generates annual sales of $4 billion. Booz Allen has been recognized as a consultant and an employer of choice. In 2007, for the third consecutive year, Fortune magazine named Booz Allen one of The 100 Best Companies to Work For, and for the past eight years, Working Mother has ranked the firm among its 100 Best Companies for Working Mothers. To learn more about the firm, visit the Booz Allen Web site at To learn more about the best ideas in business, visit the Web site for strategy+business, a quarterly journal sponsored by Booz Allen. Contact Information: AMSTERDAM LONDON Otto Waterlander Vice President waterlander_otto@bah.com Lisa Fabish Senior Associate fabish_lisa@bah.com Robert Oushoorn Senior Associate oushoorn_robert@bah.com Stuart Groves Senior Associate groves_stuart@bah.com Downloadable digital versions of this article and other Booz Allen Hamilton publications are available from

7 Worldwide Offices Asia Australia New Zealand Bangkok Beijing Brisbane Canberra Hong Kong Jakarta Melbourne Seoul * Shanghai Sydney Taipei Tokyo Wellington Europe Amsterdam Berlin Copenhagen Dublin Düsseldorf Frankfurt Helsinki Istanbul * London Madrid Milan Moscow Munich Oslo Paris Rome Stockholm Vienna Warsaw Zurich North America Annapolis Junction, MD Arlington, VA Atlanta Boston Chantilly, VA Charleston, SC Chicago Cleveland Colorado Springs Dallas Dayton, OH Detroit Eatontown, NJ Falls Church, VA Herndon, VA Honolulu Houston Huntsville, AL Leavenworth, KS Lexington Park, MD Linthicum, MD Los Angeles McLean, VA Newark New York City Norfolk, VA Omaha Parsippany, NJ Philadelphia Rockville, MD Salt Lake City San Antonio San Diego San Francisco Stafford, VA Tampa, FL Washington, D.C. Latin America Bogotá Buenos Aires Caracas Mexico City Rio de Janeiro Santiago São Paulo Middle East Abu Dhabi Beirut Cairo Dubai Riyadh * An associated firm The most recent list of our office addresses and telephone numbers can be found by clicking the Worldwide Offices link under About Booz Allen on 05/07 PRINTED IN LONDON 2007 Booz Allen Hamilton Inc.