Building Software for Sarbanes-Oxley

The Sarbanes Oxley Act of 2002 is one of the most comprehensive changes to the rules and regulation that govern public company financial reporting and internal operations. Most of those companies are desperately trying to tie up the loose ends in their financial reporting and controls procedures before looming deadlines. But they are about to get hit with a brand new reality that is surely to cause even more lost sleep at management level. Everything these organizations do from this point forward will be subject to a compliancy test and review. This includes new initiatives as well as change to existing processes. The ability to spot negative trends is going to become more critical when the covenant established in Section 409 of the act really takes hold.

Nervous Times for Internal Audit

The internal audit teams are most often charged with the task of ensuring compliance with Sarbanes Oxley’ and they complete this task by using existing structures such as COSO (Committee of Sponsoring Organizations of the Treadway Commission) to help them identify areas that may produce inaccurate and material financial reporting. The goal of these groups is to identify known failure points in financial reporting mechanisms and place controls on the processes in order to ensure accuracy. For example a financial trader can buy or sell a hedge instrument on behalf of the organization but in order to ensure that everything is legitimately shown in the financial reports, the trader is never allowed to book or control the journal entries that record the transaction nor are they allowed to confirm the deal with the counterparty. This ‘separation of duty’ control point allows the executive of the organization some reasonable level of assurance that the financials accurately reflect the position of the organization. Now this is a simplistic example of a more complex problem because often the trade ticket and journal entry are created automatically within trading systems and it’s these operational systems that are going to become the focus of compliance work over the next decade.

The internal audit teams currently conducting reviews of processes and controls most often do not step outside the realm of the financial reporting. However, some of the major audit firms are requiring an IT security audit to be performed before an attestation will be provided for Sarbanes Oxley compliance. That, however, is usually the extent of the internal Sarbanes audit scope as it relates to systems. The problem is that financial records are historic by their very nature. The books of the organization are always in arrears as a representation of the state of that organization. Prior to Sarbanes Oxley this was not an issue but with the implementation of section 404 and 409, the accrual basis of record keeping has proven to be insufficient to meet compliance. For this, the SOX teams have had to study, map and test the controls processes to ensure that actions to be performed in the future cannot bankrupt an organization.

Why Controls Fail

In general, Sarbanes Oxley was a response to the scandals that engulfed the financial markets starting in 2000 with the failure of Enron. The SEC was charged with trying to restore the public’s faith in the capital markets and to that end they created the Sarbanes Oxley act. The goal was to provide the PCAOB (Public Company Accounting Oversight Board) a tool that they could use to hold the management and boards of public organizations accountable for the failures of those organizations. But the realization that the financial reports could easily be manipulated by rogue executives quickly gave rise to the importance of control and policy. By the 2002 the SEC and PCAOB had realized that in order to effectively restore the public’s faith they would have to ensure that policies and controls in public corporations were not just in place but had been tested. They also went one step further by not only forcing the executives of those organizations to attest to and accept responsibility for the controls, but they also forced those same executive to report on developing trends that may materially affect the financial statements.

However, financial reporting controls are often initiated long after a transaction has occurred. In the case of Enron nothing disallowed the use of derivatives to shift financial numbers from one account to another. Eventually when the reporting finally caught up to the reality of the day, the entire house of cards collapsed. In fact financial reporting controls were in place at Enron. The problem was that there were few effective controls over what the executives did day to day. That would have to be caught by controls over the physical actions of the organization. Remember our trading example from above. The separation of duty between the trader and the treasury accountant is a financial reporting control. The separation of duty between the trader and the backoffice confirmation staff is a physical control. It has nothing to do with the financial records but has everything to do with ensuring the trader does not risk the future of the organization with bad or rogue deals. The controls that are most likely to fail within organizations today are the physical controls and it is those controls that also have the greatest impact on the organization and its continuity.

How Software Can Aid in Compliance

The greatest growth opportunity in software revolves around the issue of controls and trend identification. As executives and boards come under increasing pressure to identify and publicly disclose material trends, as well as attest to ongoing control mechanisms, the requirement for true ‘real time’ systems and exception reporting will be invaluable. So what kind of value can IT companies provide in new world of compliant development? Here are five options currently under review by some of the largest financial and operation software organizations in the world.

1. Realtime Information Compilation and Exception Reporting. The organizations that can bridge the gap between various disparate systems and combine that with realtime exception reporting tools will provide a measurable value, especially if the development of the exception report can be done inhouse by the organization.
2. Imbedded Compliance Tools The key issue for organizations making changes will be to ensure that their current compliance status is maintained when systems are changed. The ability to easily transfer data from old to new systems will be one of the critical testing points. The most successful systems will be those that offer automated data migration validation mechanisms, change audit trails, integrated policy control modules, new data object controls, automated test units and imbedded security controls and exception reporting.
3. Integrated Physical Process Mapping The ability for company’s to add new systems or initiate new development will rely on the systems ability to map the physical processes, control points, responsibility assignment and automated controls testing mechanism. Helping organizations easily provide the controls assessment reporting and validation will shorten the purchase decision process.
4. Imbedded Physical and Virtual Asset Monitoring The ability to monitor the physical assets of the organization as well as virtual assets will prove to be one of the most important issues in the next few years especially as value is assigned to the virtual assets and intellectual property of the company. Digital right management (DRM) will be at the forefront of these developments.
5. Action Based Monitoring Inclusion of audit trails complete with the ability to set test criteria for actions in the system will allow executives the ability to have customized reporting on key areas where trends might develop. The easier the ability to report on trends the more lead time the executives will have to mitigate or reverse negative developments.

The growing trend towards increasing compliance has created an opportunity for IT organizations to assist public companies in understanding the necessity of managing physical processes in real time. Areas as diverse as DRM to data aggregation to distributed real time systems all have a key role to play in making it easier and less costly to comply in fundamentally better ways than simply through financial reporting controls. The opportunities are limitless for those IT organizations ready to make the leap.