Understanding the Sarbanes-Oxley Law: for Latin American companies, compliance offers competitive advantages.

For Latin American companies, compliance with the U.S. Sarbanes-Oxley Law makes good business sense. By implementing new technologies and adopting best practices in corporate governance, senior managers can earn the trust of their shareholders and make better strategic decisions through better access to vital information.

"There is increased awareness among multinational companies that investors are expecting increased transparency and visibility," says Jim Gunn, chief financial officer for SAP Latin America. "Even if your company is not legally required to comply with Sarbanes-Oxley, your customers, shareholders and communities are looking for compliance to elevate their transparency and visibility."

Compliance can also provide Latin American companies with competitive advantages, such as making their shares more attractive to U.S. investors, or enhancing their bids for contracts with U.S. companies. Better record keeping is another plus.

"There can also be cost benefits from a traditional risk management perspective," adds Gunn. "For instance, if you can document that you are compliant with Sarbanes-Oxley requirements, you might save money on errors and omissions (E&O) insurance for directors and officers."

The Sarbanes-Oxley Law, approved by the U.S. Congress and signed by President Bush in July 2002, was a step forward in a worldwide movement for better corporate governance. Under the law, CEOs and chief financial officers must certify that their financial controls are effective.

The law's many provisions apply to approximately 14,000 publicly traded U.S. companies and 1,300 foreign corporations, including nearly 300 in Latin America. But that's only part of the story. Other large Latin companies, as well as suppliers to major enterprises, are moving to comply with the law, as experts see a "trickle-down" effect throughout the region.

"Most companies looking to expand their relationships internationally should be studying how to benefit from these compliance measures," says Luis Arturo Diaz, financial services director, Oracle Latin America, Miami. "It's not just about compliance, but gaining an advantage through lowering compliance costs, and having the flexibility to meet compliance deadlines. Even small and medium businesses are looking into ways they can adapt to these regulations to improve their competitiveness."

Financial authorities in Europe and Asia are also setting higher standards for corporate compliance. In many cases, compliance architecture for Sarbanes-Oxley can also be adapted for other regulations, such as the Basel II standards in the financial services sector.

"Many companies that don't have to comply with Sarbanes-Oxley are finding it to their benefit to implement IT best practices," says Rogelio Montekio, country marketing director, Computer Associates, Mexico City. "Most of these practices are tied to internal policies and controls--how you document and provide access and information to people and how you keep records of internal actions."

For multinational companies, IT compliance solutions can provide more consistency in reporting and accessing information. "That's important," says Gunn, "because a multinational may have subsidiaries in the region at different levels of maturity."

Compliance is a combination of people, processes and technology, according to Ken Williams, vice president of technical services, Computer Associates, Jacksonville. "Technology solutions may involve security, storage, operations and change management," he says. "Organizations need to look closely at their current systems and see what improvements may be indicated."

For example, a company may need to harden its technology platform to prevent malicious or fraudulent acts. IT managers must monitor and audit the system to prevent unauthorized access or other problems, and a management system is needed to make sure controls are effective.

One of the most critical elements in Sarbanes-Oxley is Section 404, which addresses the security of a company's internal controls. Typically, two of the biggest areas of compliance problems are user provisioning and change access, says Williams.

"User provisioning is how to authenticate and authorize people to gain access to financial documents and records," Williams says. "The law is strict on violations of segregation of duties. That means a user in accounting, for instance, should not have access to accounts payable or accounts receivable records. As for change access, that typically means that a developer who creates source code or tests for applications should not be allowed access into operations or production. Auditors are looking closely at this aspect."

Williams adds that Section 802 of the law requires companies to retain evidence of controls for seven years. Examples include audit logs, business continuity plans, and documentation of the change management process. "You need to have a digital storage vault and have a way to say to the auditor--here are my documents that support my certification that I have effective and efficient controls," he says.

Summing up Latin America's growing need for effective compliance solutions, Gunn says, "Gearing up to meet these requirements can be seen as a financial and time burden. But compliance is also an opportunity to drive value through the organization. You can't lose sight of the benefits."

PROVIDERS OF SARBANES-OXLEY SOLUTIONS

COMPUTER ASSOCIATES

Computer Associates International (CA) offers a diverse portfolio of compliance solutions, including Identity and Access Management Suite, a standards-based solution for automating and integrating identity and access management across enterprise, customer and partner environments, CA delivers software and services across operations, security, storage, life cycle and service management to optimize the performance, reliability and efficiency of enterprise IT environments.

For more information, visit www.ca.com

SAP

SAP[R] software for managing compliance works with mySAP[TM] ERP to provide a complete, integrated solution for ongoing Sarbanes-Oxley-compliant accounting, reporting and compliance. It also can be implemented as an add-on to SAP R/3[R]. The SAP software's key components are designed to improve and streamline the auditing process, internal controls management and "whistle blowing" procedures.

For more information, visit www.sap.com

ORACLE

Oracle[R] Internal Controls Manager helps companies reduce the cost and complexity of ongoing compliance by automating internal control documentation, testing, and monitoring. Oracle's complete architecture for sustainable compliance includes Oracle E-Business Suite and Oracle Collaboration Suite, combined with identity and security management technologies.

For more information, visit www.oracle.com

HITACHI DATA SYSTEMS 

Hitachi Data Systems, provider of data storage and management solutions, offers software, hardware and services to assist Latin American governments and companies to comply with new regulations that not on y demand data protection but also require its retrieval at any time. Hitachi can help you implement data life cycle management solutions through archiving policies, guaranteeing process certification based on ITIL methodologies. These solutions guarantee data retention and integrity, information archiving and immediate content retrieval.

More information at www.hds.com