A proper accounting

Pulp & Paper, Oct 2004 by Kutz, Tim, Marcotte, George, Stone, Les

The Sarbanes-Oxley Act places a heavy burden on finance and IT departments to improve internal and external communications

In 2002 congress passed The Public Accounting Reform and Investor Protection Act. Under the principal sponsorship of senator Paul Sarbanes and representative Michael Oxley, the legislation is more popularly known as "Sarbanes-Oxley" or "SOX."

SOX was enacted to restore confidence in the capital markets and enhance the integrity of the accounting system in response to a number of major corporate and accounting scandals involving some of the most prominent companies in the U.S. SOX establishes new or enhanced standards for corporate accountability and penalties for violation.

SOX is comprised of 11 titles that address compliance and accountability requirements, standards, and expectations for publicly listed companies on U.S.-based exchanges. For forest products companies, undertaking SOX compliance is akin to becoming compliant with EPA Cluster Rule guidelines and legislation. Frequently, the scope of effort required to become SOX compliant is on the scale of a Y2K conversion.

While several of the key sections of the act have already taken effect, this article focuses on the implications of section 404: Management Assessment of Internal Controls. The significant increase in the number of securities class-action lawsuits and associated losses from 2000 to 2002 (Figure 1) is evidence that businesses continue to struggle with internal controls long after the accounting scandals reshaped the U.S. equity markets.

Section 404 takes effect for periods ending November 5, 2004, and after, and it requires each annual report of the issuer to contain an "internal control report," which:

* States management's responsibility for establishing and maintaining an adequate internal control structure and procedures for financial reporting

* Contains an assessment, as of the end of the issuer's fiscal year, of the effectiveness of the internal control structure and procedures of the issuer for financial reporting

* Requires the company's external auditor to attest to and report on the assessment made by the management of the issuer.

Key implications for business and IT

Section 404 will place even more demands on finance and IT organizations to support the business and keep analysts and shareholders comfortable. Moreover, it is important to recognize research findings that suggest the market favors companies that demonstrate improved financial disclosure. Management may have a more effective capability to address key business fundamentals and minimize risk. Figure 2 depicts this relationship in an analysis of public energy entities that have become vulnerable under the weight of public scrutiny.

Finance and IT organizations will be challenged with additional rigor in providing adequate and efficient financial and management information control and accuracy as well as partnering with other business organizations to deliver reliable results and add value. Similar to Y2K results, internal control and accuracy will only be as strong as the weakest link-be it transaction, consolidation, or reporting based. Finance and IT should expect significantly increased internal and external expectations to:

* Ensure GAAP and SEC compliance

* Produce accurate external forecasts and help to manage them

* Provide timely and relevant management reporting

* Ensure consistent adherence to internal controls

* Proactively assess and manage operational risks.

To deliver on these expectations, finance and IT organizations will be required to partner with other organizations in the business to:

* Provide information technology that delivers accurate information, permitting reliable data-based decision making and promoting collaborative analysis

* Improve and document financial processes and provide subsequent education to other organizations within the business to facilitate corporate-wide ownership of the reporting process

* Deliver value-added analysis and insight to improve business performance

* Ensure adequate involvement and expertise in core operational processes, strategic business processes, and major projects where internal controls exist and financial information is sourced

* Develop people who have the skills and tools to play a broader role in managing and analyzing the business

* Evaluate core competencies and outsourcing activities that do not add value to the process.

Companies have traditionally found it difficult to provide a definitive source of direction for compliance and reporting requirements that guide the development of these capabilities. This is primarily the result of the SOX documentation's lack of a clear definition of internal control. However, the U.S. government and its agencies have accepted the use of the U.S. auditing standards outlined in standard AU319 and will reference this standard for compliance with Section 404.

AU319 incorporates the definition of internal control from the Committee of Sponsoring Organizations (COSO) from the Treadway Commission Report of 1992. COSO broadly defines internal control as a process-effected by an entity's board of directors, management, and other personnel-designed to provide reasonable assurance regarding the achievement of objectives in the following categories: