The debate over Sarbanes-Oxley

Chief Executive, The, May, 2005 by Timothy P. Flynn

In true running terms, compliance with Section 404 of the Sarbanes-Oxley Act was a demanding dash for all involved, but only the first lap in a much longer journey.

Corporate America expended significant resources to meet the recent reporting deadlines in the Sarbanes-Oxley Section 404 compliance process. While it proved to be hard work and extremely time-consuming, there is little doubt it will improve the integrity and transparency of financial reporting in the years ahead, thus benefiting the capital markets and shareholders.

For most large companies, this is the first time that such a mass of data has been codified around their financial controls environment, as well as around the processes and systems related to those controls. Many executive teams already are using this information to execute action plans to remediate control deficiencies and are beginning to embed a systematic approach to monitoring compliance and test controls effectiveness.

Armed with their controls "portfolio," executives now have an in-depth understanding of the nature and effectiveness of their internal controls over financial reporting and the business processes they impact. This knowledge provides corporate leaders with a new lens through which they can evaluate their business--a new means of considering and controlling risk, improving the quality of their financial reporting, and driving a return on the Sarbanes-Oxley Section 404 compliance investment.

Our experience has shown that focusing on the performance of controls provides the most significant opportunity to help bring efficiencies to the enterprise by identifying key controls over financial reporting, eliminating redundant controls, streamlining the business processes they impact and better managing risk.

For instance, when control activities are manually oriented and "detective," they tend to be time-consuming, expensive, prone to human error and occur after the fact. That affects business performance and raises total costs. It reveals, in fact, the hidden cost of controls.

Now, through the Section 404 compliance process, companies--many for the first time--can see the mix of "manual" versus "automated," and "detective" versus "preventive" controls within their organization. Progressive organizations are replacing the dated processes of the relatively expensive and labor-intensive manual controls to make way for the more automated controls. For example, companies that some years ago installed new ERP systems are finding that those systems have embedded automated controls that had never been activated. Simply turning on the appropriate, embedded ERP controls can improve the controls environment. These are one-time expenses that will yield savings and efficiencies in future years.

[ILLUSTRATION OMITTED]

In implementing Section 404, organizations must have a dual focus: build sustainable confidence through an ongoing assessment process for compliance; and achieve added value by balancing risk and the cost of controls, while identifying and pursuing business process improvement opportunities.

During each phase of the journey, the organization will seek to use improvements in controls over financial reporting to drive improved business performance. Along the way, the question, "How do we comply with Section 404?" becomes, "How can we use controls as a new lens to support the integrity and value of financial reporting and be a catalyst to improve business processes?"

Timothy P. Flynn

Vice Chair

Audit and Risk Advisory Services

KPMG