Advantage: Sarbanes-Oxley.

Just one year after the biggest change in corporate reporting was signed into law since the 1930s, most financial executives have made the move from shock and awe to acceptance and action. And they have a lot of help, as the US. entrepreneurial nature is spawning an array of Sarbanes-Oxley compliance activities--including software, publications, conferences and a slew o( information--for dealing with and coping in the new environment. The new attitude gives a positive spin to the inevitable. It says: We can't fight it," we have to do it, so let's turn it into an advantage.

At a recent corporate governance session at the Nasdaq Marketplace--co-sponsored by Nasdaq, Oracle Corp. and FEI--keynote speaker Jeffrey Henley, Oracle CFO and Executive Vice President, said of Sarbanes-Oxley: "It is not optional. There is a lot of expense, time and effort. But we've come to believe there is probably some real value that, hope fully, we are going to get. We didn't start out years ago thinking about Sarbanes-Oxley, but it turns out that the things we have done have dove-tailed very nicely with some of its requirements."

He then explained how Oracle had four years ago launched a major initiative to globalize and e-enable its five operating divisions in 60-plus countries, to get them all operating on one common set of business applications. The original goals were to centralize and automate processes to lower costs, improve efficiency, improve controls and to get better information for the company to improve transparency and accountability. Little did Oracle know that the Sarbanes-Oxley Act would require certain of these functions, in addition to having the CEO, CFO and the company's auditors attest to the accuracy of the information. Oracle's initiatives were applied across the company--finance, human resources, procurement, supply chain and customer relationship management--to get everyone around the world doing the same thing.

Henley describes the resulting enormous database as "a single source of truth, "where all of the applications integrate with each other and pass information between themselves and update or set up different, new information in the common database. "Now, documenting all of Oracle's processes and procedures will only have to be done once," he said.

The notion of controls involves many different things, one of which is having better information. In terms of managing internal controls--the heart of Section 404, Henley believes--the basic idea is to document all the processes and policies, and redocument on the COSO framework. "The COSO framework is much different than the way we approach things. So we've taken the opportunity to re-evaluate and rethink all of our practices--with our internal auditors."

It's like peeling an onion, he added, and after a tremendous amount of effort, Oracle learned that it had some holes. "By getting an airtight system, we think we'll get more efficiency out of it, besides having better controls," Henley said. Oracle's internal control environment is highly centralized, giving it a "leg-up" in terms of having rock-solid controls and fewer break points, he said, and, with everyone reading from the same page, he believes fewer things can go wrong.

Oracle's internal audit function has also changed since Sarbanes-Oxley. The internal auditors used to report to Henley and then separately to the audit committee. "We changed that over the last year and added dual-reporting responsibility, to the audit committee and to me, for day-to-day oversight and additional help for compliance and documentation," he said.

Also, in line with Sarbanes-Oxley, Oracle has added a number of tools for building a culture of compliance using Web-based ethics and compliance training, testing, certifying and re-certifying. Its Code of Ethics is accessible through its Web site for managers and executives around the world to read, answer a series of questions and get re-certified. With Sarbanes-Oxley requiring continuous recertification, Henley noted, the self-service nature of the Web is helpful; it's also effective for making policy changes.

Also, like many other companies, Oracle has added a hotline that enables anonymous phone calls from employees to voice concerns about the business. "We do business in a lot of countries, and unfortunately there are a lot of issues the cultures and ethics are different--so despite all the training over the years, having a way for employees to anonymously report things is proving to be interesting," said Henley. He noted that "some turn out to be blind alleys, but unfortunately--or, maybe fortunately we are discovering there are more issues out there than we realized that don't always show up in audits and that sort of thing."

He said doing all the extra work has cost the company millions of dollars, and going forward, he expects to spend more effort and money on internal auditing and on extra audits. Yet, he's resigned to doing it. He also thinks that the worst is over for his company, and that it is approaching the point of getting "a lot of value from the system and not a lot of incremental new costs."

Henley presented a strong case for getting the job done: "Consolidating all of your systems and information, going to shared-service centers, automating processes, maximizing self-service--all of this really creates better visibility and accountability, better control and a better way to run your business in a most efficient manner possible."

"Oracle has the right idea," says Eric Wright, President, REL Americas, in an interview. "Oracle has recognized that Sarbanes-Oxley needs to become embedded in the way it does business--as part of its normal process." REL Consultancy Group specializes in improving total working capital for companies worldwide.

Wright seized the opportunity to make the analogy between Sarbanes-Oxley compliance and strategic planning, suggesting to clients: "As long as you're spending that much--why stop there? Use it to your advantage, as part of your strategic plan."

When studying the process for compliance, he says he found the work consistent with the process his firm uses when launching initiatives. "We send a small team out to conduct interviews across an organization--to look at a company's systems and policies and decide whether or not those are the best practices that will allow the company to get the best financial results. If not, we make recommendations on how to improve them."

The exercise to go out and document internal controls for Sarbanes-Oxley, says Wright, is the same process. "We help clients figure out what really drives the businesses, and how to make changes in those areas that have the biggest impact." He notes that this is precisely what Sarbanes-Oxley is doing--focusing on those things that have the most material effect on the business or that represent the most material risk. What's beneficial about the process, he adds, is "it forces companies to be very broad in their perspective--they have to look across the entire spectrum. That's something that's new."

Now, however, Wright says, there is uncertainty associated with Sarbanes-Oxley. Along with other global and economic concerns, it's causing a kind of stagnation among businesses around the world. There is confusion and uncertainty, and many companies have adopted a "wait-and-see" attitude and aren't moving forward. "I think that is dangerous," he says.

Wright's message: "Sarbanes-Oxley is not separate and distinct. Think of it within the context of how you do your strategic planning, and continue to launch the initiatives you would otherwise launch. In addition, coordinate these with your audit group--with Sarbanes-Oxley as the backdrop. Compliance is costing companies in the millions of dollars, just to be able to say 'I've documented all my controls, and I'm ready for the first test.' That is a substantial investment. A little tweaking in mindset could justify the expense."