Don't take your eyes off the ball! - SOX Section 404 Extension (Continued)

The additional time allowance will enable foreign companies having to prepare for, and initially comply with, two different sets of significant new financial reporting requirements within a similar time period. The extension will also grant smaller issuers that are subject to the Exchange Act reporting time to consider the new guidance in the COSO Framework (The Committee of Sponsoring Organizations of the Treadway Commission). The three new components of the COSO framework are objective setting, event identification, and risk response

The extension should make implementation of the internal control reporting requirements more effective for non-accelerated filers and all foreign private issuers. As a consequence, this will give support to investors and aid the development of confidence as to the reliability of the disclosure made by these companies about their internal control over financial reporting.
However, companies must not rest on their laurels on the progress made thus far. Sitting back and taking a break from Sarbanes-Oxley could create a greater risk for these companies as their Section 404 compliance projects may inevitably start to lose momentum, not to mention the resources allocated to them as normal business activity resumes in the interim period. This was evidenced in the US when a number of companies took three or four months off after their initial extension was granted, and then found it extremely difficult to pick their projects up again and focus on the objective following this period of inactivity. As a result they're now fighting to meet the revised deadlines.

In order to be able to implement a purposeful Sarbanes-Oxley project, companies should be spending this additional time to review their current status and ensuring they have a solid foundation in place from which to move forward, because without it, they will be unfocused and unmotivated.

Consuit has identified the following three areas as being essential in order for good 404 project management and have proved to be effective in order to achieve compliance.

1. Culture
2. Methodology
3. Communication

1. Culture
Culture, in this context, can be defined as "effective communication between personnel within an organization with a means to achieving a common goal".

The culture within an organization needs to change to one that understands the importance of Sarbanes-Oxley compliance, not only to the company, but also to the effect that non-compliance could have on the employees themselves. Without this culture change the company could be left in an exposed position, such that the attitudes and mindsets of people will not be focused enough.

2. Methodology
Many companies seem to realize they have a deadline in which they must have documented, tested and remediated their key-control activities affecting their financial processes. What they fail to realize is that Sarbanes-Oxley requires a very structured approach to managing such a project and without understanding exactly what it is that is required, not to mention, what it is that they require from the project, then a never ending circle of confusion will be set upon them.

Organizations very often confuse different levels of information within their documentation, simply because they adopt an accountancy based approach.
A suggested approach in documenting business processes and one that is easily manageable as well as being relevant to the whole organization could be:

• In preparing documentation based on the above methodology, it is clear that there are several levels of detail in which one can "drill-down" for more specific process style information, as is needed, and therefore avoids a "one page" approach which is all too common.
• In simple terms, this methodology permits the right information to get to the right people in order for them to do the right job and avoids having to gauge what level to pitch at,

3. Communication
Many companies are very organized in setting up a Project Management Office ("PMO") and having dedicated personnel managing specific areas of their global operations, which allows for a positive start to the project. What seems to be the failing point however is that communication often seems to be held at either a PMO level or a sub-group level, and as a result the chain of communication is broken very early on in the project.

<<< PREV I NEXT >>>