What works best: a private university takes flight after selectively implementing best practices from the U.S. Sarbanes-Oxley Act

Internal Auditor, Feb, 2006 by James K. Seaman

BY ITS TERMS, THE U.S. SARBANES-OXLEY Act of 2002 applies only to publicly traded companies. But the act's goals--reliability, transparency, and accountability--are equally important in other organizational settings, including the nonprofit sector. For that reason, Sarbanes-Oxley has garnered the attention of nonpublic corporations, not-for-profit entities, and professional associations, as well as the government agencies that interact with these groups.

[ILLUSTRATION OMITTED]

Like publicly traded companies, nonprofits have numerous investors, including the donors who help fund them and the board members and volunteers who donate their time. Driven by mission more than financial gain, the stakeholders in a nonprofit organization--which include individual beneficiaries of the nonprofit's efforts and the communities to which it contributes--want to make sure that funds given to the organization are used efficiently and for the intended purpose. The mere appearance of waste, misuse, or even simple inattention can be devastating to the organization.

Most nonprofits never have such problems, but when they do, the news tends to become public very fast. In August 2005, for example, The Washington Post reported that American University's governing body received an anonymous letter alleging misuse of funds by the university's president. That same month, the newspaper itself received and then published a similar letter that alleged expense account violations by the president and his wife over a five-year period, indicating the couple had used university funds to pay for their son's engagement party, a personal French chef, and vacations in Europe. The Post also featured a three-part series on The Nature Conservancy that examined the philanthropic environmental group's president and chief executive officer, Steven J. McCormick. Among other items, the series highlighted The Conservancy's failure to disclose elements of McCormick's 2001 compensation, such as a US $75,000 signing bonus and a home loan for US $1.55 million.

The media is not the only group giving exposure to such issues. The U.S. Congress has held two committee hearings since 2004 on whether Sarbanes-Oxley should be expanded to cover tax-exempt organizations. The U.S. Senate Finance Committee announced it will convene another hearing that many believe could include discussion of a version of Sarbanes-Oxley for nonprofits and foundations (see "A Call for Reform" on page 46 for further discussion of the government's activities). Professional organizations have called on their members to examine Sarbanes-Oxley and make reforms voluntarily, before the government mandates them. Moreover, nonprofit board members are placing pressure on their organizations under threat of rep-utational risk and personal liability.

These and other developments place governing boards on alert that the public expects the same fiduciary accountability from nonprofit boards as it does from their for-profit counterparts. As a result, nonprofit organizations are beginning to look at Sarbanes-Oxley for guidance on their financial reporting. At Drexel University, a private, nonprofit institution in Philadelphia, university management and board members examined Sarbanes-Oxley to determine which aspects might be appropriate for a higher-learning environment. In November 2002, Drexel adopted the "spirit" of the act, implementing portions that best suited the needs of the organization. It was the first university in the United States to engage in this process, and the benefits have been substantial. Selective implementation of Sarbanes-Oxley principles has enabled the organization to run its operations like a for-profit firm.

STARTING THE PROCESS

Ultimately, the decision to incorporate elements of Sarbanes-Oxley at Drexel was made by the university's president, Constantine Papadakis. He believed the organization should be managed like a corporation and that its Board of Trustees and senior management team should be held to at least the same standards as publicly traded entities. Working with a special committee of the Board of Trustees, Drexel's president and his management team spent considerable time studying the act to determine which of its provisions would be most applicable to an academic environment.

The board's special committee reviewed Drexel's governance, compliance, and audit issues. In addition, the university retained an independent audit firm to conduct an enterprise risk management (ERM) assessment. The auditors based their risk assessment on The Committee of Sponsoring Organizations of the Treadway Commission's (COSO's) Internal Control--Integrated Framework, largely recognized as the de facto standard for Sarbanes-Oxley reviews. The assessment covered both Drexel University and the Philadelphia Health & Education Corp. (PHEC), Drexel's nonprofit medical-school subsidiary.

Drexel's assessment was conducted in the spirit of Sarbanes-Oxley. It represented one of the first stages of adopting principles from the act--in this case, Section 404's requirement for establishing an adequate internal control structure. The assessment helped strengthen corporate governance and evaluate where the organization stood from a risk perspective.