Companies step up to the Sarbanes-Oxley challenge.

For most U. S. public companies, implementing Sarbanes-Oxley has been extremely costly. Corporate governance and the concept of sustaining internal controls are key in the minds of nearly every corporate executive in the United States. As company executives put their final touches on their assessment of financial reporting controls under Section 404, they have come to realize not only the financial burden, but also one that has consumed valuable internal resources. Smaller organizations have been hit particularly hard since compliance costs consume a disproportionately high share of income when compared to larger organizations. At a recent Public Company Accounting Oversight Board (PCAOB) roundtable, one speaker noted that his company's compliance costs were 6.5% of sales, when prior to Sarbanes-Oxley its total General and Administrative expenses amounted to just 8% of sales.

"One large Southern California firm's CFO reports that Sarbanes-Oxley-related initiatives consumed more than 50% of his time and is a deterrent to running his day-to-day business," comments Jefferson Wells Managing Director, Dave Gennrich. The demands on small company resources are daunting. The firm's Los Angeles Internal Audit Director, Tony Lopez says the cost of Sarbanes-Oxley compliance is doubly burdensome for his smaller clients since the required disclosure and internal controls are not currently graduated based on company size. "Many smaller companies look forward to a better balance of company size, disclosure obligations and compliance efforts," notes Lopez.

Since the introduction of Sarbanes-Oxley, leaders of small- to medium-sized public companies have felt the twin pressures of a more complex regulatory environment and a decline in the ability to leverage their external auditors to respond to these changes. Many feel they are simply at the mercy of the regulators and external auditors when it comes to meeting compliance requirements. In addition, the new regulations have seriously strained relationships between external auditors and issuers.

Background

Each major regulatory agency has launched activities to study and recommend changes to ease the regulatory burden on small- to medium-sized public companies. While some relief is both possible and probable, SOX is here to stay and relief will most likely be more incremental than broad.

In December 2004, the SEC launched the Advisory Committee on Smaller Public Companies. This group's charter is to "assess the current regulatory system for smaller companies under the securities laws of the United States and to make recommendations for changes." The committee meets periodically for one year and provides recommendations for rulemaking to the full Securities and Exchange Commission. Its June 2005 meeting confirmed the overall agenda for its work. We anticipate the committee will seriously consider and potentially propose changes to the SEC regarding the definitions of an accelerated filer and a small business under regulation S-B at the next meeting on August 9, 2005.

In coordination with SEC efforts, in January 2005 the Committee on Sponsoring Organizations (COSO) launched its Implementing the COSO Control Framework in Smaller Businesses project. The project's purpose is to provide concrete control examples that small business can use to achieve financial reporting objectives.

Steps Management Can Take Now

It appears external auditors are not planning major changes to their approach as organizations move into the 2005 audit season. In addition, any relief from regulators is likely to be minor for the upcoming reporting cycle. This leaves it up to the management of small- and medium-sized companies to proactively address issues related to compliance and begin to make changes to positively affect their compliance experiences.

Management can undertake the following steps to begin to address these issues:

Enhance Governance Processes and Procedures

* Leverage compliance efforts to improve the strategic alignment of key initiatives and enhance overall performance management to capitalize on elements driving business value. Good governance makes good business sense.

* Strengthen the audit committee by increasing its role in fraud risk assessment, enterprise risk assessment, and the selection and management of key controls.

* Improve the process for selecting, training and supporting Directors regarding their roles and responsibilities, and the risks and issues facing the organization.

Strengthen IT Governance and Controls

* Review and evaluate IT-governance processes to ensure sufficient value is delivered from IT projects.

* Bridge the gap between finance and IT, streamlining or eliminating key controls.

Re-shape Compliance Efforts Into a Sustainable, Ongoing Process

* Review current compliance activities and identify ways to reduce the number of key controls, increase the use of control self-assessments and improve the overall control environment to better match compliance efforts to risk.

* Implement an ongoing fraud and risk management process to reduce losses.

* Improve the finance organization's capabilities. By focusing on the value provided by the finance function, organizations will naturally improve governance and controls.

Why undertake these activities now? Jefferson Wells believes that as organizations progress along the compliance continuum, they increase the value extracted from processes and key initiatives, regardless of the regulatory and auditing environment.

In addition, by starting now companies can reap future benefits as regulatory relief is provided to smaller businesses. Why? Because it is highly likely that most changes in compliance requirements will be based on improved risk and governance practices.

This article was provided by Jefferson Wells. For more information, please contact Jefferson Wells Managing Director Dave Gennrich at 949-885-1560, or via e-mail, [e-mail].