What will you do in Sarbanes-Oxley's second year?

As your company races to finish the work necessary to comply with Sarbanes-Oxley's Section 404, consider one simple question: Do you want the second year of compliance to be a replay of the first?

It's a question that will stop many financial executives dead in their tracks, because despite the substantial resources deployed on Section 404 compliance projects, the work was somewhat chaotic--and for some companies, it still is. For those with 2004 deadlines, the last few months couldn't be characterized as a marathon, but rather like a decathlon--replete with hurdles, sprints and pole-vaults, and culminating in a muscle-straining, vein-popping shot put.

But, endure you must, because, unlike other races, you can't just drop out of the Sarbanes-Oxley competition. So take a tip from this coach: The secret to prolonged success is not to run harder, but smarter. This means you must plan for, design and implement an efficient and effective program for sustainable compliance. What you did during the first year was necessary, but not sufficient for the long run.

Impending deadlines drove many Section 404 projects, with little time devoted to long-term planning. But as the calendar rolls around to year two, the breakneck pace slows, and some perspective can be attained. Here's some advice for sustaining compliance for year two and beyond:

* Throw away the Band-Aids. In year one, many applied a Band-Aid; in year two, more comprehensive treatment is required. Many, understandably, treated Section 404 compliance as a discrete project with a clearly defined ending point. But this "project" mindset is fallacious and hindering. There is, in fact, no end date for Section 404 compliance, anymore than there's an end date for filing 10-Ks.

Thus, perspective needs to change. The tenets of good governance and internal control mandated by Sarbanes-Oxley must become integrated into the mission, culture and daily activities of your company; anything less comprehensive represents a stop-gap approach.

* Preparation. The journey involves moving from a 404 project mindset to a sustainable compliance program, to strong internal control as part of your company's DNA. The first leg of the journey got you to year-one compliance--neither the finish line nor the final destination. Continuing on to sustainable compliance will be much different from the first-year's documentation, testing and remediation.

* Build processes. A triage approach may have been the only workable tactic during the first year, but over subsequent reporting periods, more order and structure needs to be imposed. Ad-hoc techniques should yield to methodical ones; makeshift solutions should give way to integrated ones; and short-term thinking to long-term thinking.

Most important is the need to develop well-designed, repeatable, sustainable processes. Work more closely to integrate financial reporting and internal control. Just as you have a well-defined process for closing the books on financials, so, too, should you have a structure for closing your books on internal control.

* Reinforce your control environment. All employees should be dedicated to good corporate governance and strong internal control. Additionally, depending on company size, industry and other factors, certain staff may need to be dedicated--full- or part-time--to compliance.

Allegiance to the doctrine of corporate governance does not magically appear, it must be cultivated. Employees will embrace it only if they receive proper guidance, instruction and modeling. This is where the credo of "tone at the top" comes into play, and continuing education on Sarbanes-Oxley, business ethics, internal control and related topics is critical. Employee roles and responsibilities should be explicitly defined, repeatedly communicated, seamlessly integrated and closely monitored.

* Extricate internal audit. The internal audit function proved a lifesaver for many companies, providing key personnel for internal control assessment, testing and remediation work. But a problem can arise with continued reliance: The regular tasks of internal audit--operational, systems and special project work--suffer when the function is redeployed.

The solution? Either return to pre-Sarbanes-Oxley responsibilities, or significantly increase resources for the function to accommodate the additional workload.

* Address risk. Establishing a systematic risk identification and management program is an essential element of Section 404 compliance, and, unfortunately, an area that many take too lightly. Internal controls should be viewed from a risk-based perspective, and greater attention should be paid to potential high-risk areas. For example, control environment risks often present greater problems than more routine control areas such as payroll or accounts payable.

* Exploit technology. It is hard to believe that, two years ago, conventional wisdom held that Sarbanes-Oxley compliance would have little or no impact on information technology (IT). Nothing could have been further from the truth. IT is critical for achieving the goals of the Act, and the impacts and implications for IT are significant and pervasive.

Application-level controls and general computer controls have been a major focus of attention in year-one projects. Many companies have used technology to help manage their 404 efforts, and to provide a controls repository and an audit trail.

The biggest impact on IT lies ahead. Sustainable compliance has impacts throughout the IT application architecture, on IT governance and in IT business processes. Technology will enable the integration of financial and internal control monitoring and reporting, which will be key to most large and complex enterprises.

Imagine an internal control system fully integrated with financial monitoring and reporting systems, and a program that allows users to drill down from financial results to the underlying controls; or one that automatically flags exceptions, unauthorized entries and other anomalies. In most cases, the efficiencies gained by leveraging such technology will rapidly offset the implementation costs. The costs and risks of not automating to the fullest extent possible could be significant.

* Normalize change. If your company isn't changing, it probably isn't thriving. New products, expanded markets, shifting priorities, growing revenues--all of these, and more--are indicators of a dynamic organization. But while change is often a barometer of success, it can also be a harbinger of internal control headaches.

In this new era, virtually every change that your company undergoes will have an impact on internal control. Obviously, major events like a merger, acquisition or a new IT implementation will present significant compliance implications. But smaller, everyday occurrences--personnel moves, department restructurings, market shifts, process changes--will also have a ripple effect.

As a result of this natural and continuous evolution, many of the processes and procedures that were so painstakingly documented over the last year will be revised, redundant or retired over time as the company advances and grows.

Will this cycle of change repeatedly throw your company back to square one in terms of Sarbanes-Oxley compliance? Or will it have the adaptability and flexibility to respond to organizational, regulatory and market changes as they occur? Clearly, effective change monitoring and management will be critical to avoiding fire drills in years two, three and beyond.

Knowing compliance was not optional, but essential, you spent significant resources--time, talent, energy and money--on the 404 project. Now you have (or will have) a documented, assessed, tested and remediated internal controls program, and a better understanding of your internal controls. You also have gained valuable knowledge and insights about your data, processes, systems and organization. The 404 work has shed new light on challenges and opportunities for improvement.

This is an opportunity to leverage all you have learned. You are almost certain to find complexities in your data, processes and systems. Unnecessary complexity raises the cost of compliance and increases the risk of a breakdown in controls, and makes it harder to produce high-quality financial information. Reducing unnecessary complexity is a key to making compliance less painful and it's important in order to achieve value from your substantial investment in compliance.

Among the many positive outcomes of year one of the Sarbanes-Oxley era is the near unanimity among executives that they don't want to redo this process again. With the past as motivator, they will be inspired to fully integrate the principles of good governance into every corner of their organizations--infusing it in their philosophy and communications. The more completely that the notion of strong internal control seeps into the collective business psyche and influences decision-making and day-to-day activities, the smoother the road to sustained compliance will be.

Lee Dittmar is a Principal at Deloitte Consulting LLP and Leader of the Sarbanes-Oxley Integrated Service Offering. He can be reached at [e-mail] or 610.479.3952.

[ILLUSTRATION OMITTED]

by Ellen M. Heffes