In the sandbox with Sarbox.

There has been a lot of moaning and groaning since Congress passed the Sarbanes-Oxley Act, but I personally cannot understand how a business can function without appropriate controls and with material weaknesses.

I am the owner and CEO of my business. I have controls to ensure that things are as they should be; if I didn't, the business would go downhill and employees would go into business for themselves on my time and my dime. I have the right employees, systems that allow them to succeed and reward them for that success, financial and accounting reporting both from the business and from an independent accounting firm, and an understanding that the results are still my responsibility.

So why shouldn't big business wish to embrace sane and reasonable measures to ensure its long-term success? It starts at the top. If the top is lax or relaxed about accountability and controls, then no one else will have any reason for concern. Instituting controls that are the requisite for long-term success will more than pay for themselves, so let's make friends with Sarbox. We may find that "he" is a real friend after all.

Jack Donner

CEO

America's Best Self Storage

Torrance, Calif.

While many affected organizations have invested significant time and money related to ensuring compliance with Section 404, others have utilized the process to achieve business improvements and to secure competitive advantage. These firms have done so by taking a broader perspective beyond financial controls when addressing enterprise risk management.

A number of leading organizations in the financial services and communications industries that are dependent upon digital technology for their critical missions have adopted this broader perspective based on two key factors. First, the COSCO framework includes "the efficiency and effectiveness of operations" within the defined objectives of internal controls. Second, downtime and/or security breaches at mission critical operations may have material impacts on financial results.

While the financial performance of the host organization often depends on these digital systems, the systems may be outside of the scope (and the expertise) of the controls compliance reviews prepared by the independent outside auditor. Recent events have shown that these systems should not, however, be outside of the scope of the senior executives and boards of directors responsible for protecting shareholder value and who are charged with overseeing enterprise risk management.

Broader perspective will not only mitigate liability exposure, but, if planned and executed properly, will also lead to the identification of improvements to internal business operations and to the development of programs that will enable the host organization to establish competitive advantages.

Why? Because in addition to cost/benefit analysis, the improvements will be evaluated to ensure that they will be well-received, important initiatives to one's own customers. The customers realize that any breakdowns in the supply chain to their own customers, whether from internal or external sources, may have cascading impacts on others, including themselves.

Harvey Goldman

President & CEO

Syska Hennessy Group

New York