Keeping an eye on Sarbanes-Oxley: the Sarbanes-Oxley Act is creating an ever-evolving new landscape for corporate governance, making it critical organizations worldwide to pay attention.

July 30 marked the one-year anniversary of the enactment of the Sarbanes-Oxley Act (SOx). A the central focus of SOx is to improve the integrity of the audit process for publicly traded companies and the reliability of audit reports on corporate financial statements. With the act, Congress gave prosecutors and the Securities and Exchange Commission (SEC) new tools to oversee the financial reporting of publicly traded companies. It also created the Public Company Accounting Oversight Board (PCAOB) to specifically oversee the accounting industry's role in the auditing and reporting of the financial soundness of publicly traded companies.

In testimony presented September 17 to the Committee on Banking, Housing, and Urban Affairs of the U.S. Senate, SEC Chairman William H. Donaldson said, "The act represents the most important securities legislation since the original federal securities laws of the 1930s."

The full impact of SOx has yet to be felt. However, this important legislation is constantly evolving, making it critical for organizations' top executives and records and information management (RIM) professionals to keep a close eye on it.

Several rules have been adopted recently that affect organizations and their RIM programs. In the coming year, the PCAOB will make several more key decisions concerning SOx registration by foreign firms, auditing, and inspection processes--all of which will ultimately affect RIM programs.

Internal Controls Rules

Section 404 of SOx became effective August 14. This section requires publicly traded companies to implement "internal controls over the financial reporting process" and to include a report of these controls in their corporate reports. As a practical matter, as discussed by the SEC, internal controls over financial reporting are considered a subset of "disdosure controls and procedures." The internal controls report will address management's responsibility to establish controls over financial reporting and will require it to evaluate the controls' effectiveness.

Depending on their filing status, publicly traded companies must begin to comply with the manage merit report on internal controls over financial reporting disclosure requirements either on June 15, 2004, or April 15, 2005. According to Donaldson, "For many companies, the new rules on internal controls reports will represent the most significant single requirement associated with the Sarbanes-Oxley Act." Perhaps because, as part of an organization's evaluation of its internal controls, it is expected that certain controls and procedures will be tested and that this evaluation process may trigger a review of the company's document retention program.

In its final rule implementing this requirement, the SEC slates that management's assessment must include: (1) "controls over initiating, recording, processing, and reconciling account balances, classes of transactions and disclosure, and related assertions included in the financial statements"; (2) "controls related to the initiation, processing of non-routine and non-systematic transactions"; (3) "controls related to the selection and application of appropriate accounting policies"; and (4) "controls related to the prevention, identification, and detection of fraud." The SEC further states: "An assessment of the effectiveness of internal controls over financial reporting must be supported by evidential matter, including documentation, regarding both the design of internal controls and the testing processes."

Section 404 also requires a company's auditing firm to review and attest to management's assessment of these controls. According to Donaldson,

"The required annual evaluation of internal controls over financial reporting will encourage companies to devote adequate resources and attention to the maintenance of such control Additionally, the evaluation should help to identify potential weaknesses and deficiencies in advance of a system breakdown and may help companies detect fraudulent financial reporting earlier and perhaps deter financial fraud or minimize its adverse effects."

The rules adopted by" the SEC define "internal controls over financial reporting" as "a process designed by, or under the supervision of, the issuer's principal executive and principal financial officers, or persons performing similar functions, and effect ed by the issuer's board of directors, management, and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles and includes those policies and procedures that

* pertain to the maintenance of records that in reasonable detail accurately and fairly reflect the transactions and dispositions of the assets of the issuer

* provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the issuer are being made only in accordance with authorizations of management and directors of the issuer

* provide reasonable assurance regarding prevention or timely detection of unauthorized acquisitions, use, or disposition of the issuer's assets that could have a material effect on the financial statements."

New Auditing Standard

Donaldson said the PCAOB currently is writing a new auditing standard related to auditors' testing and reporting on companies' internal controls over financial reporting. The standard will complement the commission's rule requiring management officials to report the effectiveness of their internal controls.

On August 4, the commission issued a notice stating that the registration requirements and procedures related to auditors of non-public broker-dealers still are being considered and delaying required registration until January 1, 2005, or the adoption of applicable rules, whichever occurs first.

Inspections and Disciplinary Programs

On July 28, implementing the directive in Section 104 of SOx, the board proposed rules relating to inspections of registered public accounting firms. The board's inspection rules include

* "regular" inspections that will take place annually for firms that issue audit reports for 100 or more public companies

* regular inspection of all other firms every three years

* a "special" inspection that may be authorized by the board at any time

PCAOB Chairman William J. McDonough testified on September 17 that the board has begun regular inspections of the four largest U.S. accounting firms, which agreed to cooperate with the board prior to their registration Regular inspections will begin in 2004 for all accounting firms. Inspections of firms with less than 100 issuer audit clients will be phased in over the three-year inspection period.

The board said its inspection program gives it the most extensive contact with registered firms and their management as well as a view of the quality of the audits that have been conducted. The inspection program also is one of the places where the board will exert pressure to change auditor behavior when necessary.

According to the PCAOB chairman's testimony: "[The inspection program] will provide us with a direct window into the registered firms to see how they are implementing the standards, the board sets, areas where they are doing particularywell, and areas where improvements are needed."

There are a number of areas on which the board's inspections will focus that have not been the traditional focus of the peer review process, including the following:

* an evaluation of the "tone at the top" of registered firms. The board wants to know the nature and frequency of the messages that are coming from the highest levels of the firms.

* a look at partner compensation and promotion. The PCAOB will look into what behaviors are rewarded--and thus reinforced--through compensation and promotions.

* consideration of organizations' overall communication and training practices to all their professionals

Registration of Foreign Firms

The PCAOB has made significant accommodations in its registration system for foreign accounting firms. These accommodations include providing a mechanism to ensure that foreign firms are not asked to violate laws in their home country in order to register with the PCAOB, narrowing the scope of the information provided to the PCAOB, and extending the registration deadline for foreign firms.

Any U.S. accounting firm that audits a company that is publicly traded in U.S. markets was required to register with the board by October 22.

Foreign accounting firms that audit companies whose securities trade in U.S. markets also must register with the board, but there is a 2004 deadline for those registrations. According to McDonough, the PCAOB has received more than 500 registration applications from foreign firms and is in the process of reviewing them.

Although the registration process has not yet begun for foreign firms, the board is taking steps to "spread the Sarbanes-Oxley philosophy worldwide." McDonough says the PCAOB has contacted officials in Europe, Canada, and Japan to discuss potential "joint registration" methods for foreign accounting firms. Under such a system, a foreign company could register with a foreign oversight board-type entity that would be required to follow and enforce all SOx requirements.

McDonough said the board also envisions a joint process for inspecting auditing firms' activities in countries whose inspection capabilities meet U.S. standards. That arrangement could also enable the board to help its foreign counterparts inspect their registered auditing firms' activities in the United States, he added.

McDonough recently said the board is conducting a thoughtful analysis of the nature of its oversight of foreign accounting firms that audit the financial statements of U.S. public companies and is discussing with foreign regulators ways to accomplish the inspection and disciplinary goals of the act without subjecting foreign firms to unnecessary burdens or conflicting requirements.

As corporations worldwide keep their eyes and ears focused on SOx and any related new regulations or rules, so, too, must RIM professionals. To consistently meet SOx's requirements and regulations, organizations must ensure their internal communications, recordkeeping processes, and other procedures operate so that important information flows to the appropriate collection and disclosure points in a timely manner. To achieve these goals, RIM professionals must ensure they play a key role in their organization's implementation of SOx.

Editor's Note: For more on the Sarbanes-Oxley Act of 2002, see "Preserving the Paper (and Electronic) Trail" in January/Februmy 2003; and "Sarbanes-Oxley One Year Later" in the July/August issue of The Information Management Journal and the Sarbanes-Oxley Act: Implications for Records and Information Programs, available at www.arma.org/bookstore.

SEC Enforces First Sarbanes-Oxley Penalties

In the first case enforcing the provision of the Sarbanes-Oxley Act (SOx) that calls for executives to swear to the accuracy of their company's financial statements, the Securities and Exchange Commission (SEC) recently settled civil injunctive actions against Rica Foods and two of its top officials.

According to the SEC's complaint, on January 13 Miami-based Rica Foods filed an annual report with the commission that purported to have been approved by the company's outside auditor, Deloitte & Touche. The audit report suggested Rica Foods' financial statements were presented fairly and in conformity with generally accepted accounting principles. At the time of the filing, however, Deloitte had not provided Rica Foods with a signed audit report and the company's financial statements contained "material classification errors," the SEC's complaint stated.

The SEC's final judgment directed Rica Foods to stop violating SEC rules governing the accuracy of issuer books and financial disclosures, and directs Chief Executive Officer Calixto Chaves and Chief Financial Officer Gina Sequeita to no longer aid and abet rule violations. Chaves, Sequeira, and the company face the possibility of even tougher penalties if they violate SEC regulations in the future, and Chaves must pay a $25,000 civil penalty. The SEC said Chaves and Sequeira consented to the final judgment without admitting or denying the allegations in the commission's complaint.

Rica Foods, whose units raise chickens in Costa Rica for fast food chains including McDonald's, recently hired a new independent auditor and filed an amended annual report containing a signed audit.

Document-Tampering Charges Brought Under SOx

Charges were brought under SOx in another recent case involving a former Ernst & Young audit partner.

Federal agents arrested Thomas C. Traugher on two obstruction of justice charges for allegedly altering and destroying documents related to his work with NextCard Inc., an Internet credit card company whose finances were being probed by federal bank and securities regulators. Prosecutors alleged Traugher altered and deleted documents to make it appear that Ernst & Young had thoroughly considered key financial issues at the San Francisco company. Another former Ernst auditor, Oliver Flanagan, pled guilty to helping Traugher obstruct an investigation by the Office of the Comptroller of the Currency (OCC) and the SEC into how a subsidiary of NextCard handled bad loans on its books, according to prosecutors.

The legal action takes advantage of "additional tools" provided by SOx, which gives prosecutors more leeway in bringing charges against those who seek to destroy, alter, or falsify financial information and records.

Ernst interviewed Traugher as part of an internal investigation and discovered problems, which it brought to the attention of authorities in May 2003, an Ernst spokesperson said. Prosecutors said the document tampering dates back to early 2001, after Traugher had completed his review of NextCard's 2000 books. The OCC began to investigate NextCard in March 2001, which prompted the company to change its accounting treatment of certain credit card defaults. According to court papers, Traugher became worried about his work and told Flanagan that they needed to "beef up the work papers and ensure that their files would not be combed over by lawyers if they were subpoenaed.

Traugher and Flanagan altered or destroyed key paper and electronic documents related to the audit of NextCard's financial statements for 2000 and two quarterly reviews in 2001, according to an FBI agent's affidavit. The agent said Traugher also lied under oath about the document tampering in an interview with the SEC earlier this year.

If convicted, Traugher would face up to 20 years' imprisonment and fines of more than $250,000. Flanagan faces up to five years but may receive a shorter sentence because he is cooperating with the investigation. Ernst & Young was not charged in this case because the document tampering appeared to be the work of a small group of individuals within the firm, sources told the New York Times. But federal officials say the investigation is ongoing.

Frank Moore is director of Smith, Bucklin and Associates" Government Relations Public Policy Practice Group and ARMA's government relations consultant. He may be contacted at [e-mail].

Nikki Swartz is Associate Editor of The Information Management Journal. She may be contactes at [e-mail].