How Technology Makes SOX Work at SCE
There is much conversation among treasury practitioners about the long-term financial value of the Sarbanes-Oxley Act on U.S. and global corporations. Certainly there are those who see Sarbanes-Oxley as a burden: an additional set of regulations that while providing shareholders and analysts with executive accountability, do so at an enormous cost in terms of software, programming and consulting.
Southern California Edison (SCE), one of the largest electric utilities in the U.S., and a subsidiary of Edison International, holds a different view of the Act. Their treasury department and corporate executives see it as a positive move, and embrace the requirements as a safeguard to the organization. After spending three years in crisis management following the energy crisis in California in 2000, and a near bankrupting investment downgrade in 2001, SCE is a company keen to put safeguards in place.
By late 2002, it was obvious that controls surrounding financial statement reporting would soon experience significant changes as external audit firms would be requiring assurance – through extensive audits – that companies like SCE were fairly representing the performance of the company. This meant that as SCE’s Cash Manager, Tim Bint would have a personal role in using technology to adopt the SOX requirements at the company’s treasury.
When an onlooker reviews SCE’s balance sheet, the first line he or she sees is “Cash and Cash Equivalents”. As SCE’s Cash Manager, Tim Bint’s priority was he says to, “ensure that we were comfortable with all the processes that we controlled so that we could make the right declaration to management – for our area of responsibility – that the numbers reflected in the financials were accurate.”
“Having just emerged from three years of crisis management, it was apparent that as a department we would need to proactively review front-to-back all of the treasury operations, controls and financial reporting related to cash and its relationship to accounts payable and accounts receivable. Since the department is also responsible for managing the company’s short-term borrowing and investing, we needed to be able to attest to the accuracy of the ST interest income, interest receivable, ST debt outstanding and ST interest expense,” Bint says.
And so in early 2003, SCE established the framework for their cash reporting project. The project’s primary focus was to document the company’s entire banking structure, their treasury system, accounting techniques and bank reconciliation processes. This included documenting more than 100 accounts at 15 banks. It was a big task and one which required the partnership of strong technology.
Bint says “At the heart of the program was our ongoing commitment to providing senior management with a tool that would ultimately identify where the risks in an organization lie as they relate to the structural characteristics of the company’s bank accounts. The danger that has always been present with treasury operations is that only those ‘engineers running the boiler room’ – the cash management folks – really had a true understanding of the daily risk related to literally millions, if not billions of dollars in cash flow that were ultimately consolidated in the company’s financial statements each period,” Bint said. He believes that creating a cash control program that bridges the gap between the ‘boiler room’ and the ‘board room’ is one way treasury departments can adequately support their company’s quarterly SOX certification requirements.
“Technology plays an important role in our new process given the fact that SOX is a quarterly event so we need to demonstrate our ability to manage this data on a regular basis. Technology also helps us to create n objective approach to bank account risk. It is no longer one personas opinion but a process subjected to a corporate standard.
The process itself is now controlled via the software and it also gives us the ability to simulate various scenarios. We can test what impact adding debit filters will have on our over all risk score. We can then hold this up against the increased cost for such a service.
Without the technology it would be hard to make the process consistent and repeatable, something that is very important for SOX as well as audit in general,” said Bint.
The project to create a cash control program officially kicked off in July 2003 and was completed in August 2004. In that time the treasury department reviewed account-by-account cash flows, the collection of daily transactions into their treasury workstation, and the accounting entries generated both systematically from the treasury workstation and manually by company analysts.
SCE found that it was able to enhance its cash controls as a result of the project. The company says that it maintained a manageable balance between the extra human resources spent in supporting the new controls while also strengthening their ability to support the SOX reporting requirements. The project resulted in the addition of one full-time employee, a compliance accountant who oversees the day-to-day cash control program that was developed as a direct result of the cash reporting project.
The nuts and bolts of the Cash Control program SCE has developed are nearly as involved as the Sarbanes-Oxley Act itself. First the company had to look at each bank individually – and then at each account in order to develop a matrix which included information about how each account was established and what specific risk characteristics were related to each individual account. A series of questions were developed to analyze the risk characteristics of each. Some of the questions included the following:
Is there a debit filter on the account?
Where is the bank reconciliation being performed?
Is there a direct relationship between the bank account and a G/L code in the balance sheet or income statement?
How many signers are on the account?
Is there a positive payee on the account?
Does the account ZBA to a master or is it a stand-alone that needs to be funded?
Are wire transfers allowed on the account?
Is the account part of a daily balance reporting process?
Is the account managed by a centralized treasury organization or is a district/field office responsible?
A graduated point scale was assigned to each risk component. Each risk category was then summed and used to determine which accounts carried higher structural risk than others, and therefore needed closer attention in order to give senior management confidence in their quarterly certifications for SOX.
Since SCE’s treasury workstation didn’t incorporate these structural risk points, the company initially had to develop a spreadsheet to track each bank account. While the spreadsheet accomplished their short-term goals, ultimately they knew they needed a treasury workstation that incorporated this structural risk tracking, so more robust reporting and analytics could be accomplished with less manual intervention.
Bint contacted their current treasury solutions vendor to discuss the cash control program with its related structural risk tracking. SunGard responded positively to the idea of adding these features to their AvantGard-BRM Core+ solution.
“Ultimately, SCE supports the foundations of SOX because by certifying to our senior management our confidence in the accuracy of the financial statements, the treasury department is ultimately enhancing our shareholders’ confidence in the company,” said Bint. “The California energy crisis hit this industry in a way never imagined before 2001; but it taught us the value of investing our time and financial resources in managing risk in a way to enhance shareholder confidence,” he added.
SunGard Treasury Systems’ team says that adding the audit and control features were a natural extension of their focus on corporate governance in the AG-BRM product. The AvantGard BRM module is based upon the AG Framework, a service oriented architecture employing .net technology. According to Bent Benjaminsen, SunGard’s Senior Vice President of Strategic Initiatives, SEC’s technology choice has allowed them integrate future features such bank fee analysis and a payment dashboard without implementing entirely new software.
What is the client’s perspective on the technology? “I am very pleased with the flexibility and advanced reporting capabilities available within the Beta version of the AvantGard BRM module that our organization has been using. The platform supporting BRM appears to be robust enough to be able to provide a level of bank account risk profiling and reporting that to date has never been available within a commercial treasury software package,” said Mr. Bint, when asked his perspective on the technology solution provided by SunGard Treasury Systems. “Moving our spreadsheet-based risk profiles to SunGard’s AG-BRM solution has been easier than I thought. We are now looking to merge the structural risk components into our implementation of the AvantGard-ICMS treasury workstation during Q1 2005. SunGard’s treasury solutions programmers responded quicker than I could have imagined when asked to consider incorporating our risk profiling techniques into the AG-BRM module. Based on what I’ve seen to date, we definitely made the right choice in selecting SunGard as our treasury technology partner,” he added.
Corporate governance in treasury is a complex environment where dealing limits, payment approvals and simple operational risk must be addressed adequately. It is no longer enough to report on these items after the fact. Treasury clients are now subject to ongoing tests and controls. Benjaminsen, explains, “Relying on rule-based decision software has become more critical in order to manage and simulate bank account structural risk.” He points out that SCE’s treasury staff now uses a toolset previously used for the finance industry to determine risk profiles and tolerance levels.
“Given that the data required is available through different sources, the move toward using web services has become more critical. Being able to pull in different data sources and subject the data to modelling while still maintaining the integrity of the data is what everyone is looking for”, says Benjaminsen. Considering the challenges of managing operational risk, cash flow forecasting or liquidity management within governmental regulations, the need to consolidate and simulate data is ever increasing.
By end 2004, SCE was getting ready to certify that sufficient cash controls were established and were being followed. While making this certification required significant time and resources from the company, it has resulted in their treasury personnel having a more complete understanding of how all the banking transactions inter-relate, and how they are accounted for in the financial records of the company.
Bint believes that from the client’s point-of-view, it is important that other services continue to be migrated in order for the energy company to take full advantage of the new web service technology. “SCE would like to see all of our external and internal treasury services follow this strategy so that we can ultimately receive better and more accurate information,” Bint says. “The ultimate goal is to create information dashboards that can easily be configured and distributed without the need to re-engineer or purchase new software, and we feel that the SunGard AG-BRM module has taken the first step,” he concluded.