Year One: Sarbanes-Oxley. Companies Find Some Good with the Bad and the Ugly. Author: George Hogenson, Ph.D.

Transcription

1 THOUGHT LEADERSHIP SERIES Sarbanes-Oxley Year One: Companies Find Some Good with the Bad and the Ugly Author: George Hogenson, Ph.D. SENIOR VICE PRESIDENT, PROGRAM DEVELOPMENT HUDSON HIGHLAND CENTER FOR HIGH PERFORMANCE Writer: Sharon Sutker McGowan, Desktop Edit Shop, Inc.

2 HHHHHHHH H H HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHH HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHH HHHHHHHHHHH HHHHHHHHHHHHHHHHHHHHHHHH HHHHHHHHHHHHHHHHHH HHHHHHH THIS YEAR, FOR THE FIRST TIME EVER, CORPORATE ANNUAL REPORTS WILL INCLUDE AN ASSESSMENT OF THE EFFECTIVENESS OF ORGANIZATIONS INTERNAL CONTROLS, AS REQUIRED BY SECTION 404 OF THE SARBANES- OXLEY ACT OF 2002.

3 p2 It has taken public companies thousands of hours and millions of dollars to document their business and financial reporting processes, examine how the processes are controlled and test those controls. In the aftermath of this monumental effort, Hudson Highland Group talked to experts and practitioners about the challenges of complying with Section 404, what companies learned about running their businesses and whether the reforms will restore investor confidence shaken by accounting scandals at Enron, WorldCom and other companies. Those interviewed agreed that the compliance process was difficult, but that it taught them worthwhile lessons. They are doubtful, however, that improving internal controls resonates with investors at this point, although the cumulative effect over time may be positive. The Sarbanes-Oxley Act (SOX) was the most significant change to federal securities law since 1934, when the Securities Exchange Act was passed. In addition to redesigning the reporting obligations of public companies, the law tightened accountability standards for directors, officers, auditors, securities analysts and legal counsel. It also established the Public Company Accounting Oversight Board (PCAOB) to oversee the accounting industry. There is no doubt that companies are taking Sarbanes-Oxley compliance very seriously. One thing that seems beyond question is that there has been a big response to this act, commented Rick Antle, William Beinecke Professor of Accounting at the Yale School of Management. Whether driven by fear of attracting negative headlines or uncertainty about the acceptable level of documentation, companies have made major investments to comply.

4 p3 For example, Dow Chemical Co., a $10.9 billion company, started working on 404 compliance in March 2003, and spent more than 100,000 hours documenting, testing, remediating and retesting, according to Financial Executive. That figure does not include the time spent by outside consultants or auditors. A survey of 224 companies conducted by Financial Executives International in July 2004 found that companies with less than $100 million in annual revenues expected to spend an average of 2,143 internal people hours and 837 external hours on year one Section 404 compliance. Companies with more than $5 billion in revenues expected to spend an average of 73,312 internal hours and 10,834 external hours. The entire thing has been a very burdensome task, said Dennis Vanek, director of Internal Audit at The Sports Authority, Inc., the largest sporting goods retailer in the United States, with $1.8 billion in 2004 revenue. We ve taken extensive steps, from hiring a consulting firm to assist us in setting up the program management office to setting up a steering committee comprised of executive level management personnel to ensure that the right resources are available and dedicated to the project, said Vanek, who has spent full time on SOX compliance since January SARBANES-OXLEY YEAR ONE: COMPANIES FIND SOME GOOD WITH THE BAD AND THE UGLY An important question, according to Antle, is whether the Sarbanes-Oxley reforms are meaningful in the way people think and act and practice, or are they additional boxes that people check off, and then go off and do whatever they were doing before. To be meaningful, all the actors including executives, auditors and financial analysts would have to change the way they think and act, he said. But since there s no way to guarantee that people will act any better, regulators put in 15 more steps for them to do I think that we didn t have enough evidence to believe that the internal control system itself was really that broken before Sarbanes-Oxley, Antle added. However, Sheryl Skolnik of BDO Seidman said she believes that some of the highly publicized scandals were probably reflective of a poor internal control structure. Sarbanes- Oxley has definitely strengthened the role of the audit committee at many companies, she said. Skolnik is national director of Information Systems Assurance for the public accounting firm, one of the largest in the United States. In addition, external auditors have added a long list of items that they look for in their engagements as a result of the accounting scandals. We continually evaluate our audit approach in light of new happenings, said Skolnik.

5 p4 Several of those interviewed pointed out that it is more likely that a failure in operational rather than financial controls will result in a major problem. David Richards, president of the Institute of Internal Auditors (IIA), noted that a poor business decision could result in significant financial loss, even though the numbers are all correct. As Vanek, of The Sports Authority, put it, Sarbanes-Oxley [doesn t say] you have to be a good businessman. It just says that whatever decisions you make you have to record properly in your financial statements. At the same time, a failure in internal controls does not mean that the financial statements are inaccurate, said Richards. CHALLENGES Among the challenges companies faced was to define key controls the ones that should be tested. There are literally thousands of controls in companies. The question is, which ones do you really rely on for the financial accuracy of information? Richards said. Sarbanes-Oxley requires companies to document processes that may not have been written down in the past. Vanek said that was the most important change at The Sports Authority. In our company there always has been a strong focus and interest in internal controls that comes from the top. Because of that, Sarbanes-Oxley didn t cause a dramatic cultural change. It was just a matter of writing down everything that we were doing. Failure to document processes is one of the main deficiencies that companies are identifying. Typically what we re finding is that people have the controls but they re not documented, and that s across even the big companies In the Sarbanes world, if you don t keep evidence, it didn t happen, said Steve Witte, practice director at Hudson Financial Solutions. Witte has worked with more than 20 companies on SOX compliance. The PCAOB has defined three degrees of deficiencies control deficiencies, significant deficiencies and material weaknesses. Companies only are required to report a material weakness, a deficiency that results in more than a remote likelihood that a material misstatement of the annual or interim financial statements will not be prevented or detected. The chief executive of PricewaterhouseCoopers, a Big Four accounting firm, estimated that about one in 10 public companies will have to report a material weakness or will be unable to meet the deadline for complying with Section 404, according to the Associated Press. Samuel DiPiazza made his remarks at the January 2005 World Economic Forum annual meeting in Davos, Switzerland.

6 Sarbanes-Oxley [doesn t say] you have to be a good businessman. It just says that whatever decisions you make you have to record properly in your financial statements. Dennis Vanek, Director of Internal Audit, The Sports Authority, Inc.

7 p6 In addition to documentation failures, other common deficiencies include lack of control over third-party providers of services; lack of a formalized journal-entry review process; and failure to institute a fraud prevention and detection program, according to the IIA. A major challenge for companies was to identify the owners of processes that generate financial information and have them certify that the controls are adequate. In many cases, process owners have been hesitant to do that, and have asked internal auditors to produce a statement for management that says the controls are working, according to Richards. We at the Institute don t feel that that s the right way to do it The process owners own the controls and should be accountable to their management on the effectiveness of the process that they oversee, Richards said. LESSONS LEARNED Most companies would say no if asked whether the requirements of Sarbanes-Oxley will help them run their business better, according to Richards. But when the dust settles and results are in, companies that are honest will look themselves in the mirror and say I didn t know that. The Sarbanes-Oxley control and assessment process will have driven out issues in the organization that need to be addressed. Hudson s Witte concurred. Most companies would say that there s some value in this but that they spent a lot more money than they ever needed to, he said. According to at least one credible study, 75 percent of financial executives said their companies benefited in some way from SOX compliance. The benefits included ensuring accountability of individuals involved in financial reporting, decreased risk of fraud and reduced errors in financial operations. The compliance process did not result in any surprises at The Sports Authority, according to Vanek. Nevertheless, he said the process will help the company run its business better by making everyone more aware of the importance of doing things in a controlled manner. Also a new employee can pick up a document and see how to process transactions and what reports are necessary. Craig Thompson, vice president of Finance at SoftBrands, Inc., a Minnesota-based global software company, said that the Sarbanes-Oxley process is definitely going to help us improve our internal controls. It was the right medicine for our company because it was a good process for us to go through and there were some best practices that were helpful to

8 p7 implement that we may not have implemented otherwise. SoftBrands will resume public trading in SoftBrands has emerged as a vital competitor in the ERP software market after a major restructuring. Thompson said that, like most companies, SoftBrands has identified areas for improvement. For example, the company lacked a process to cross-check that accounts payable data it was importing was accurate. It addressed this issue by switching to a spreadsheet program that automatically checks the totals. In mid-2004, when SoftBrands knew it was going to be resuming public reporting status, the company began investigating what it needed to do to comply with Sarbanes- Oxley by September 2005, the end of its fiscal year. We benefited from the fact that many companies had already gone through the process so we could learn from some of their mistakes, Thompson said. Among the most important things SoftBrands learned was that most companies underestimated the amount of work that it took to comply, and that many tried to do the work internally, failed, and then had to restart the project or engage an external firm. Recognizing that the internal accounting staff didn t have the capacity to take on such a large project, SoftBrands decided to hire external consultants. After meeting with five firms and going through a proposal process, the company selected Hudson to do the documentation of internal controls, working with an internal team that is handling remediation and the company s regular finance team. SARBANES-OXLEY YEAR ONE: COMPANIES FIND SOME GOOD WITH THE BAD AND THE UGLY Similarly, Stratasys relied on outside help to comply with Section 404. Because of our workload and growth, we didn t have the bandwidth to take this on by ourselves, said CFO Tom Stenoien. The Minnesota-based manufacturer of in-office rapid prototyping and manufacturing systems had $70 million in annual sales in We used Hudson resources extensively to guide us and do a lot of legwork in compliance according to their model and their template We were the experts on our processes and the controls, and they did virtually all the documentation and helped us with the testing, Stenoien added. As to the benefits to his company, I won t say [the SOX compliance process] wasn t helpful, Stenoien said, but I think the way the law was written has put a lot of cost in organizations without regard to their size and complexity. The one size fits all regulations that were passed resulted in spending some money that couldn t be justified in a costbenefit analysis, he added.

9 p8 I think making companies go through this exercise has its pluses and minuses. Clearly one of the minuses is the enormous expense, concluded Skolnik, of BDO Seidman. To Richards, whether strengthening internal controls is worth the cost depends on how much value a company puts on its reputation. Failure in internal control [results] not only in financial penalties, but it is also the fact that the organization s name will appear in print in a negative light, and that will impact its reputation. I don t know if you can put a price tag on that. INVESTOR CONFIDENCE It is too early to tell whether improving and documenting internal controls will accomplish the ultimate goal of restoring investor confidence shaken by the financial scandals of the late 1990s, most of those interviewed agreed. While Sarbanes-Oxley is top-of-mind for those who are working to comply, it has not hit the radar screen of the average investor. A Hudson survey conducted in November 2004 found that among U.S. workers who are also investors, 76 percent have never heard of the Sarbanes-Oxley Act of Only 7 percent said that the law increased their confidence in the leadership of public companies. The results were based on telephone interviews with 1,880 working investors, defined as those owning at least $5,000 in stocks, bonds and mutual funds. There is no question, however, that the legislation is forcing companies to take a closer look at the numbers, which may eventually result in increased confidence. A report issued by Huron Consulting Group found that annual and quarterly restatements filed last year increased 28 percent from 2003, to 414, the highest level in eight years and nearly double the number in The largest cause of restatements was revenue recognition. If you really want to restore investor confidence you ve got to be open and honest. And that s a new way of thinking for companies, Richards said. There must be transparency between what is happening and what they are saying, and if a company is making a projection into the future, there [has to be] some way to rely on the credibility of that projection, he added. To Witte, who is a CPA, the most important thing that Sarbanes-Oxley is doing to restore investor confidence is that it drew that line back between the independent auditors and the client It started to get the accounting firms back to doing what they should be doing, which is being independent.

10 The way [SOX] was written has put a lot of cost in organizations without regard to their size and complexity. The one size fits all regulations that were passed resulted in spending some money that couldn t be justified in a cost-benefit analysis. Tom Stenoien, Chief Financial Officer, Stratasys, Inc.

11 p10 Antle agreed. I think over time people lost sight of that and we kind of fell in love with the way the capital market works and just forgot about things like separation of duties, he said. He also noted that Sarbanes-Oxley has brought internal control back into the dialogue of organizations. There is expanded recognition that accounting has a role in control as opposed to just feeding into forward-looking investment decisions Nailing things down the way accounting traditionally does it is a pretty darn good thing to do, Antle said. In addition, SOX is providing the prosecutors with the means to hold guilty people accountable, whereas in the past it s been easy for them to dodge accountability, said Vanek, who called the law the RICO Act of corporate America. By increasing accountability, Sarbanes- Oxley may reduce the number of corporate frauds, and that will help build back investor confidence in the markets, he added. It definitely removes all excuses from executive management to say I didn t know. Now with Sarbanes-Oxley and the way we report things, they will know. The full consequences of SOX are yet to be determined. Among the possibilities are that the law will discourage companies from going public, or from listing on a U.S. exchange. It may prompt more companies to deregister with the SEC or go private. Another possible side effect is a shortage of CFOs, as executives decide that the pressures of that job are too great. But in the face of bankruptcies at Enron and WorldCom, and scandals at other publicly traded companies, was there any other choice? Despite his reservations about Sarbanes- Oxley, Antle said that the answer is no. It seems like it would have been very strange to have viewed the really major financial improprieties that had gone on and the accounting improprieties that had gone on, [and] not to do anything. He further questioned whether companies would have confronted the hard questions facing the governance system as a whole without doing the compliance work required by Sarbanes-Oxley. I doubt if we would, to be honest with you, Antle said. I think that the temptation would have been to just keep doing the same thing. George Hogenson, Ph.D., is Senior Vice President, Program Development, at the Hudson Highland Center for High Performance. Hogenson is an internationally recognized expert on psychology, organization and management.