Sarbanes-Oxley, section 404: from project to practice ... to best practice; in the governance and compliance arena, transitioning from 'best' to 'required' may occur faster than ever. Industry thought leaders advocate such an approach, and a number of companies have begun to set the bar.

Most companies today are conducting substantial--even massive--projects around Sarbanes-Oxley Section 404 requirements. There is a growing need, however, to transform that initial project effort into sustainable practice as companies realize that the "deadline" isn't the finish line. In fact, for shareholders and even for customers, the filing deadline is the start line, as it marks the beginning of expectations for complete, effective internal controls and transparency for management and board of directors.

In developing a roadmap to transform the project effort into ongoing practice to meet Securities and Exchange (SEC) requirements, executives and boards are carefully evaluating how they can elevate their practices to best practices that exceed shareholder expectations and provide competitive advantage. Some companies are even including customer perception and benefit in their plans and strategies. The consistent theme driving these strategies is a "tone at the top" that aspires to higher standards of both ethics and performance.

As is often the case, industry best practices ultimately become standard requirements. The early practitioners of best practices realize significant benefits and advantage while "forced followers" pay a higher premium for adopting the practice and enjoy lower returns because they must invest merely to break even. In the corporate governance and compliance arena, the transition from "best" to "required" may occur faster than ever. A variety of industry thought leaders already advocate such an approach, and a number of companies have begun to set the bar.

Companies approach compliance with different attitudes and goals. These include a project approach with the notion of a start- and stop- date; a sustained practice approach, involving continuing, consistent behavior; and a best practice approach, taking the highest ethical ground and striving for business benefit.

* The project approach can be characterized by:

Managed by a SWAT team Hunting and gathering exercise Change agents

This is a doable, but unsustainable and potentially untestable, approach to Section 404 compliance. It concentrates responsibility for compliance in the hands of a few, and is often typified by retention of outside consultants who take the process knowledge with them when they leave the company.

* The practice approach can be characterized by:

Standard operating procedure Consistent behaviors Routine monitoring

This is a repeatable approach and a necessary pre-cursor to auditor testing. Responsibility for control ownership, documentation and assessment are distributed; with that, comes distributed governance consciousness and a consistent corporate standard.

* The best practice approach can be characterized by:

Common structures for Sections 302, 404, and other upcoming requirements, like 409 Financial and other processes optimized Management responsiveness

Business benefits and reduced liabilities flow from this approach. This is the aspirational versus the minimal approach to governance, controls and compliance. It aligns the standards of adequacy for disclosure controls with those for internal controls and offers management the ability to meet accelerated disclosure deadlines. The dividends include increased management velocity.

As with any significant business decision, smart planning ensures smarter execution. The path companies take will impact their costs of compliance, the effectiveness of their control framework and their potential to realize business benefits. It's worth noting that the reverse is also true: An inefficient approach to meeting the requirements bloats compliance costs, provides an unsound control framework and disables any potential business benefits.

Suntron, a manufacturing services provider with 1800 employees, $370 million in revenues and plants across the U.S., has taken a strategic approach to its compliance efforts. Pete Harper, Suntron's CFO, says, "We are taking the opportunity to drive ongoing process efficiencies and sustainable compliance practices, which is a key aspect of our management discipline and central to our commitment to customer and shareholder value."

Harper expects to achieve 15-20 percent improvement in a number of processes as a result of this controls project and effort. Well-versed in Six Sigma and process efficiency from his years at General Electric Co., Harper believes that the results will benefit the company, its shareholders and its customers. "We think our customers are important beneficiaries of our internal controls, and our approach is an important signal about our integrity, credibility and viability." Instead of approaching compliance as a project, he opted for a solution that automated his risk assessment and process documentation efforts as required for Section 404 compliance but which also provides a platform for process efficiencies and best practices.

Similar drivers compelled Linda Olinger, corporate controller at The Greenbrier Cos. "We wanted to manage our 404 project effectively, but we need to transform compliance into a continuous practice within the company." Greenbrier is a railcar manufacturer and distributor comprised of a number of business units and divisions, with plants and facilities in the U.S., Canada, Mexico and Europe. The diversity of controls and processes between its manufacturing and leasing operations is significant, further complicated by the number of sales and leasing offices around the world.

The ability to distribute responsibility and ownership are important aspects of moving from a project to a practice. Assigning risk assessment, controls documentation and assessment and sub-certifications responsibilities to locations and business units transforms "hunting and gathering" to a standard, inclusive process that accurately maps to the right control ownership and compliance responsibilities. Both Harper and Olinger share the belief that their initial approach should result in a sustainable platform upon which they can drive best practices.

From Project to Sustainable Practice

To move from a project effort to standard enterprise practice, many executives believe companies should invest in a systematic approach that enables documented activities to be instituted, executed, monitored, tested and demonstrated. Bala Iyer, a board member at Conexant, Invitrogen and Overture and recently retired CEO of Conexant, explains, "If this were all about getting a one-time-sign off, I'm not sure you need elaborate systems. But think about when policies change and you need to, in fact, demonstrate that you have controls in place that refer to new policies, and that you are in compliance with new policies.

"When you have distributed operations around the world, and when you have changes in different parts of the world, it suddenly becomes a logistical nightmare." Iyer believes the Conexant team has excellent controls and processes in place, so investing in a system wasn't about achieving robust controls for the first time. Its focus was on cost-effectively sustaining controls and management's visibility on their effectiveness as time goes on and the business changes.

Suntron's Harper concurs that one of the biggest challenges to sustaining compliance is change in the business; his company acquires and divests plants and facilities to be responsive to changing demands. Like the processes and systems that enable confident and reliable financial reporting, Harper believes that internal controls also require a system infrastructure and processes to provide an accurate picture of the controls environment, enable management's assertions based on auditable facts and provide evidence for auditor examination.

These systems can play a crucial role, notes Steve Biskie, assistant vice president of Internal Controls at Great-West Life & Annuity, a provider of healthcare and financial solutions, with offices in 125 countries and over $3 billion in revenue. With its Canadian parent and diverse business, GreatWest has high expectations for its controls and compliance program. Biskie believes that the control framework and controls management must be responsive to acquisitions, divisional structural changes and to new management.

For example, how does management--new management in particular --understand the risk that is designed in and come to conclusions on risk tolerance or acceptance? Biskie believes that management needs visibility, not just to the controls in place, but to the risks and the cost/benefit decisions and choices implied by those controls. Single-dimension systems and the inability to extract and present a full picture to management fundamentally limit sustainability and visibility.

Echoing this complexity, Nick Moore, retired chairman and CEO of PricewaterhouseCoopers and the financial expert on several boards, concludes: "You can band-aid your way through this, but it probably won't make the audit committee comfortable, and it shouldn't make management comfortable, either. You need a sustainable mechanism, and one that adds value over time."

From Standard Practice to Best Practice

SEC and auditor standards will require companies to shift beyond the project approach to a standard practice. Standard practice demands that companies drive cost efficiencies for compliance without compromising the integrity of the controls. These efficiencies come from reducing overhead and redundancies and by reducing the costs of recordkeeping and external audits. Control integrity is maintained through genuine participation from control owners and effective monitoring and transparency.

Best practices are achieved when the systems and processes of compliance are used to drive value above and beyond compliance. These benefits drive shareholder and customer value and create competitive advantage for companies. The hallmarks include:

1. A COMMON METHODOLOGY FOR SECTION 302 DISCLOSURE CONTROLS AND 404 INTERNAL CONTROLS. A best practice applies a common standard of adequacy and visibility for both disclosure and internal controls. Disparate approaches are unlikely to withstand future litigation tests. With equivalent adequacy standards and a common platform, companies can reduce their exposure to litigation and reduce their costs of compliance while earning high marks with shareholders.

2. FULL IMPLEMENTATION OF A PRINCIPLE-BASED FRAMEWORK. By thinking beyond the controls over financial reporting to ethics and integrity, communications, monitoring and information system controls, management has the opportunity to inculcate good governance as a component of corporate citizenship. A number of adjacent rules, additional compliance requirements and best practices fall within the purview of a principle-driven framework so management can have consolidated means and methods of oversight.

3. AN ACCURATE COMPLIANCE INDEX AND AUTHENTIC CONTROL INDICATORS AVAILABLE TO MANAGEMENT. By truly utilizing the risk and controls information acquired and aggregated throughout the 404 assessment process, management can understand risk in the business and how it is impacted by environmental and decision changes. By continuing to employ this information, management can increase its velocity and profitability.

The transition from a compliance project to standard compliance practices is a necessary precursor to auditor testing because it signals the operating integrity of the company's control framework. It is also an important signal to management on the sustainability and reliability of the controls and information flow and integrity. Companies that move beyond reliable controls and aspire to best practices and business advantage reap the rewards of lower risk, higher shareholder and customer satisfaction, process and compliance efficiencies and greater executive responsiveness.

It's evident that nowhere is the tone at the top more demonstrable than a company's approach to compliance. And, those companies that are converting compliance to an asset and realizing the advantage that it presents build both credibility and value for their shareholders.

Vani Kola is CEO and President of Nth Orbit, a San Jose, Calif.-based provider of software solutions for compliance and controls. She can be reached at [e-mail] or 408.423.4680.