Choose the right tools for internal control reporting: internal control software for changing business conditions.

Excerpted with permission from the Journal of Accountancy, February 2004

As companies struggle to comply with section 404 of the Sarbanes-Oxley Act--the section that significantly tightened internal control and financial reporting requirements--CPAs can play a valuable role in helping many companies choose software tools to support compliance and enhance communication with investors, employees and regulators.

Ask (and Understand) Before Buying

CPAs can save clients or employers time and money by incorporating these criteria into the evaluation process.

* The software tool's most important functions, not its minor features.

* The vendor's viability as a going concern.

* The vendor's support plans and the software's position in its product line.

* The product's ongoing compatibility with the company's operating systems and its scalability.

* Whether the tool has a Web-based interface that employees can access without installing software on their individual PCs.

* Whether customization of the product is available or required.

* The availability of suitable vendor-supplied implementation services.

* The level of training the vendor provides.

* The extent of integration with other tools--for example, how proprietary is the database, and can users easily link it to other programs?

* Price.

* Maintenance, support and upgrade costs (direct and indirect for example, hardware and staff).

* Availability of information on any infrastructure and operating system changes or updates that could become necessary.

Available Tools

Except for generic tools--discussed below--many of these products provide a framework for adding modules in the future. The best of them establish and maintain a relationship between the overall business and its core systems and provide an internal control architecture that changes to meet the organization's evolving compliance needs.

Four Categories of Tools

1. Generic Software Tools enable users to document internal controls, reduce potential risks and provide some level of comfort that compliance initiatives are in place. Many companies already have such compliance software built into their general accounting systems. But, since such software is not dynamic--that is, it can't easily adjust to a company's changing business requirements--it provides only the most basic level of assurance and applies only to a given point in time.

2. Document Management and Workflow Tools monitor workflows and processes--applying a business unit's self-defined rules--to make them more event-driven and thus easier to manage. These tools allow users to perform detailed indexing and searching of multiple document types, including e-mail, flowcharts and narratives, to organize and retrieve text, images and numeric data. They also enable companies to collect and integrate data from their various accounting systems and to create links between separate business units' discrete business processes.

3. Data Mining, File Retrieval, Pattern Recognition and Business Intelligence Tools can gather data from separate systems and organize and analyze them. This enables companies to detect patterns in financial statement data and thus improve the effectiveness of internal controls and the accuracy of financial information. Tools that perform these functions typically analyze, manipulate, sample and extract data. They also compare actual trends and patterns in financial statement accounts with expected norms to help identify irregularities that could indicate fraud or errors.

4. Business Performance Management and Real-Time Compliance Tools provide management with real-time, enterprise-wide data and provide a single repository for all company information. BPM tools add continuous auditing capability to real-time enterprise systems in the form of customized computer screens--called dashboards--that present key performance indicators that managers use to decide when and how to react to changing business conditions. Real-time compliance tools store all information in one "data warehouse," provide consistent and efficient processing, optimize timeliness and accuracy, include rapid warning and response systems and make it easier to monitor and manage risks.

The CPA should help the company evaluate its environment to determine the maturity level of its internal controls and always consider multiple vendors.

BRUCE I. WINTERS, CPA, is a certified information systems auditor focusing on Sarbanes-Oxley engagements in PricewaterhouseCoopers' systems and process assurance practice.