View

The FRONTlines Forum, a conference on corporate governance, compliance and audit practices sponsored by Certus (a compliance software company), was held in San Francisco April 21. Like the SEC's roundtable discussion held in Washington the same week, the Forum was intended to be an assessment of Sarbanes-Oxley Section 404 by in-the-trenches practitioners. As with the SEC's Roundtable, those speaking at the Forum believe Section 404 has not been a total waste of time. Benefits cited ranged from the high-level "increased shareholder confidence," to the more tangible: better risk assessment and management, as well as improved finance and IT processes. Some believed (as do we) that it could be used as a catalyst for greater efficiency, transparency and more effective risk control, to name just three benefits. At the same time, deep dissatisfaction was voiced (often with diplomatic subtlety) as to how the audit firms are handling the implementation of the law. There is too much pettifogging on the part of some audit staffs with little recognition of the purpose of the controls. It is clear that investors (whose needs, after all, are supposed to be the whole point of the law) are able to distinguish between material weaknesses that are truly material and those that are not, yet auditors have been treating each the same.

Now that the initial phase of Sarbanes-Oxley 404 has been completed, it is also clear from the discussions at the Forum that companies have much to do the build sustainable efficient compliance systems. As we have noted in our research through the first phase, most corporations have created far too many low level controls than they should have. Given the tight deadlines and the grave penalties for CFOs who have fallen short, the desire to simply deal with existing processes rather than risk problems with redesigning them was perfectly rational. Year two for many companies will focus on simplifying their control structures to emphasize entity-level controls wherever possible. Not only will this require work on the part of the companies to design these new processes and controls, audit firms must do a better job training their staffs in assessing control mechanisms. Conversations with senior finance executives over the past several months has revealed their frustration that even when they put efficient, well-designed entity-level controls in place, their auditors did not always understand their validity and insisted on unnecessary, lower level controls.

Those hoping that the law will either go away or be substantially reigned in will be disappointed, in our opinion. However, Ventana Research believes Year two of Sarbanes-Oxley will be a critical watershed for companies, audit firms and regulators. Criticism of the law is likely to increase unless auditors and the PCAOB respond to calls for greater specificity where required, and a willingness to defer to good judgment where necessary. Charles Niemeier, a member of the Board of Directors of the PCAOB, spoke many encouraging words. If these intentions translate into concrete actions at the front lines of the audit, we believe the compliance "issues" will be mitigated. It is still too early to assess to what extent this will happen.

Ventana Research believes many companies do not have the luxury of resting on their laurels this year. They will need to continue their Section 404 efforts on two fronts: finance and IT. Companies may think they had rigorous audits this year, but our discussions lead us to conclude audits will go deeper and, in some cases wider, the second time around. Moreover, we expect IT controls will be tested more rigorously over time.

Assessment

The phrase "sustainable compliance" has become the phrase of choice to describe what is US SEC registrants' ultimate goal. Ventana Research concurs with this objective. We think companies have multiple options they should consider in their comprehensive assessment of their people, processes and systems. With their first audit behind them, corporations should strive to regain the efficiency they lost complying with Sarbanes-Oxley. Our Audit and Control Study last year showed on average, compliance could consume ten percent of the time of the finance organization. We advise finance executives to consider comprehensive compliance packages (from, for example, Axentis, Certus, Movaris, Paisley Consulting, etc.), and/or leveraging their existing software packages (e.g., content/document management, workflow/process management, enterprise reporting, etc.) to enhance sustainable efficiency.