Implementing Sarbanes-Oxley: early feedback. (Regulatory).
Though much of the final rulemaking mandated by the new laws have yet to be established, early attention has centered on financial statement certification and internal controls. The following reports on the compliance experience with the new rules for three public companies.
The CEO and CFO certification process, defined by Section 302 (302) of the Act, was the primary focus of every public company through the early fall. The process calls for the principal executive and financial officers of each public company to include in each Securities and Exchange Commission (SEC) filing a certification that the officers have reviewed the report, that it "does not contain any untrue statement of a material fact," and that it fairly presents the financial condition and results of operations of the issuer.
The CEO and CFO must confirm their responsibility for establishing and maintaining internal controls, and attest that their effectiveness has been evaluated within 90 days prior. The officers must also disclose fraud and internal control deficiencies to the company's audit committee and identify any material control weaknesses to their external auditors.
SEC rules further defined internal controls using a new term, "disclosure controls and procedures," that are designed to ensure that information required for disclosure is recorded, processed, summarized and reported within the time periods specified. The SEC also recommended that companies create a disclosure committee that would report to senior management.
Though certain processes were established prior to the Act, many companies focused early compliance efforts on formalizing disclosure committees and related procedures. The Coca-Cola Co. began formalizing review routines during its third quarter. Connie D. McDaniel, vice president and controller at Coca-Cola, explained that its process included drafting a formal charter for its disclosure committee and is expected to be completed by year-end.
To support the overall CEO/CFO certification, Coca-Cola expanded its existing annual processes to each quarter. Formal written representation is required from each operating unit's president, CFO and legal counsel, as well as the heads of the company's global functions. Modeled after external auditor representation letters, elements from the CEO/CFO certification are included in addition to operating management's responsibility to identify business trends and developments. The controller's office analyzes all the letters and highlights key items to Coca-Cola's disclosure committee.
Tenneco Automotive has taken similar actions with regard to 302 certifications, formalizing processes already in place. It has compiled a disclosures control and procedures manual that details the steps involved in providing the proper disclosures. The manual also provides a timeline from the close of each quarter through the report filing date, says Kenneth R. Trammell, Tenneco Automotive's vice president and controller, and covers the preparation of earnings press releases and Management's Discussion and Analysis (MD&A).
Comprised of the general counsel, the head of the internal audit group, the controller and representatives from investor relations, corporate communications, finance and outside counsel, Tenneco Automotive's disclosure committee was formed in coordination with the filing of the company's second quarter Form 10-Q and meets at least three times prior to filing the 10-Q. The committee spearheads the company's efforts to distribute internal memoranda that alert each general manager and controller of its eight business units, as well as more than 70 plant managers worldwide, of the responsibility to establish proper due diligence at each level to ensure all material events or internal control issues are reported. The company also requires that group to complete a checklist with a smaller subset that generates a quarterly representation letter to support Tenneco Automotive's overall quarterly certification.
As part of its disclosure and certification process, RWD Technologies, a systems integrator for business and technology solutions, ensured that each of its three operating units not only provided a quarterly certification, but thoroughly reviewed the company's pending SEC filing and fully understood the implication of the certification process.
"Walking them through the Form 10-K in detail [made all the] difference between [each unit saying] 'yes, I looked at it' [the filing] versus, 'yes I read it,'" said RWD's vice president and CFO Beth Marie Buck. Along with RWD's general counsel, Buck is key to pushing changes through the organization and communicating requirements to each group's executive director, who, in turn, report directly to group presidents.
Proactive communication with and positive response from company employees is certainly facilitating the compliance process. In conjunction with the August effective date of 302, Coca-Cola communicated the requirements to the relevant employees and found that even international divisions were already well informed and focused on compliance.
"[Everyone] understood the importance," says Coca-Cola's McDaniel, but she adds that attention should be ongoing. The formalization of the disclosure process, she says, "will provide more opportunity to add more depth and texture [to company reports]." The company intends to weave disclosure standards into existing employee policies and procedures and potentially add sections to existing finance training programs. "In general, employees already have a good understanding of internal controls, codes of business conduct and violation reporting, but [we] want to add disclosure controls to [the] framework."
Focus has been shifting other sections of the Act, specifically SEC proposals regarding 404 (Management Assessment of Internal Controls), 406 (Code of Ethics for Senior Financial Officers) and 407 (Disclosure of Audit Committee Financial Expert), for which the comment period ended November 29.
Though final SEC rulemaking and effective dates for 404 have yet to be established, some companies have been taking a proactive jump on any potential control issues through enhancement of internal control review and testing related to the external audit. At RWD, implementation of a new system and the related internal control review advanced its efforts toward 404 compliance.
Tenneco Automotive's existing control self-assessment process has also proven to be beneficial. The process involves completing a questionnaire directed to a designated control person at each plant location. The form addresses specific control areas that impact financial reporting and calls for an action plan if controls are not in place. Results are summarized and reported to each location and its supervisory levels, and future internal audit efforts are directed toward addressing any concerns. Tenneco Automotive's Trammell believes this will assist in internal control attestation. "External auditors can use [the findings to identify] areas to focus on and [determine] how they view internal controls," he says.
As required by Section 406, Tenneco Automotive has also implemented a separate code of ethics for senior financial officers, using FEI's code of ethics as a model. The company already has a statement of business principles for all employees.
Many companies are keeping a close watch on actions by the SEC and the recently formed Public Company Accounting Oversight Board (PCAOB) before determining the next point of focus for compliance. RWD, for example, is waiting on the pending SEC approval for the corporate governance proposals from Nasdaq and monitoring the public company fee structure for supporting PCAOB operations.
Tenneco Automotive's additional actions include revisiting the audit committee charter and formalizing the compensation committee charters and the related processes. Other plans in process include Coca-Cola's expansion of its ombudsman office to address accounting- and audit-related issues, thus providing employees with a confidential and anonymous vehicle for filing complaints.
Most financial executives will agree that based on the volume of the new rules, time is clearly a concern. McDaniel acknowledges that the disclosure committee administration alone--from creating minutes to scheduling formal meetings--does take more time. Trammell notes that Tenneco Automotive could have as many as 12 audit committee meetings per year, and that the time spent to conduct the meeting and the related hours involved in documentation and preparation will affect finance departments in the future. Buck estimates that 80 percent of her time this fall was spent complying with the Act on documentation and communication. "Where you're headed is that people want 100 percent quality data faster, which can be difficult to deal with [when you have] a business to run," she says.
Working with varied information sources and advisors is proving to be the best approach for implementation. Companies have been working with general counsel, outside legal counsel and external auditors in seeking guidance. Sarbanes-Oxley, Nasdaq and New York Stock Exchange checklists, such as several authored by the FEI Research Foundation (www.fei.org/rfbookstore/) and benchmarking against or comparing experiences with other companies are also helpful.
Cheryl de Mesa Graziano (firstname.lastname@example.org) is a CPA and director of research for the FEI Research Foundation.
|Printer friendly Cite/link Email Feedback|
|Author:||de Mesa Graziano, Cheryl|
|Date:||Dec 1, 2002|
|Previous Article:||Fraud can grow quickly. (Forensic Accounting).|
|Next Article:||Communicating corporate governance via the Web. (Investor Relations).|