Sarbanes Oxley Shines Light on Receivables
Most risk managers by now know about the Sarbanes-Oxley Act that regulates companies registered with the Securities and Exchange Commission (SEC). The Act itself and its implications on internal control are far reaching. Indeed, risk managers may in future feel that they are under considerably greater scrutiny by CEO’s & CFO’s who accept risks and responsibilities for certification, which could include criminal penalties.
No doubt the management of companies covered by the Act will give due consideration to all necessary requirements, however, this article focuses briefly on one particular area that could easily be overlooked, and which would benefit from specific attention. That is the ‘receivables’ process, by which we mean the sales process from order to cash. Receivables are vital to all businesses, as debtors commonly form a major asset within the balance sheet before they turn into the lifeblood of cash. The receivables process, therefore, will almost always be considered a significant process and, hence, subject to the controls requirements of Section 404 of the Act which requires management to report on the effectiveness of the company’s internal controls over financial reporting.
Management need to understand the effectiveness of internal control on the sales ledger. On the face of it this would require amongst other things process mapping, identifying weaknesses, control testing, evaluating the effectiveness of key controls and documenting the actions required to ensure the effectiveness of the key controls. At the same time management would be required to identify and document the processes that have been implemented and map significant financial controls to underlying processes. Ultimately, companies under the Sarbanes-Oxley umbrella will be required to present a written assertion about the effectiveness of the internal control over financial reporting for the fiscal year, which is a relatively new concept for receivables management. ‘Cash is king’ is a well known saying in the receivables world, however mapping the process to get to that end product is not something that every credit department is likely to have given consideration to. Future rulings by the Public Company Accounting Oversight Board or the SEC may further define requirements in this area. In short, there is a lot of work to be done.
Section 404 has elevated a receivables policy and procedures manual to a level of importance that may not have been considered fully before. Such a manual would likely need to recognise how sales ledger transactions are initiated, recorded, processed and reported. Within the company there needs to be an inherent understanding of receivables processes including an ability to recognise weaknesses in controls quickly and accurately after which these need to be recorded in appropriate detail for all to follow. After all, how can the company judge effectiveness without a measure to judge it against? There must also be an understanding of testing and evaluating those processes which would be covered under internal control. Whether this is available within the company’s existing skill base is an entirely different question. The receivables policy is usually unique to each company and it requires careful recording, support and understanding by management. It will provide rules and guidelines on important aspects of the work being performed while at the same time ensuring a consistent approach.
A policies and procedures manual is not just about mapping processes, since it is important to realise that a creatively and carefully designed policy can attract customers, create a more professional image and boost cash flow as well as help to ensure and exhibit the sufficient control required under the new legislation. The receivables process is far more than debt collection and to tailor or redesign an individual policy there needs to be an understanding of the overall company attitude to sales control, which in turn may help all departments understand why and how business is transacted.
In effect, the policy outlines the guiding principles. However, given the internal control requirements, risk managers will no doubt wish to satisfy themselves that the actual receivables procedures are reviewed and carefully documented in the same way as other significant processes, which ultimately will make the policy a powerful management tool. Sarbanes-Oxley has far reaching implications in many areas not covered here, but we believe that a risk manager should be aware that there is now a spotlight on this important internal control document, which brings its significant impact to the receivables process into sharp relief.
The whole business can depend on the sales ledger department for cash, but perhaps Sarbanes-Oxley has finally elevated the receivables process and its essential control document, the receivables policy and procedures manual, to an essential status when completing certification. After all, the question every risk or credit manager should ask of themselves is, would I sign it?
This article was written by Peter Buckle and Tim Wildman of PwC’s Receivables Management Group.