A Sarbanes-Oxley Compliance Checklist for UK Companies

Recent corporate reporting failures and exposure of systemic fraud have created an appetite for certainty and precision in assessing the effectiveness of controls over both the financial reporting and operations business processes, and their vulnerability and exposure to risk. Driven by Section 404 of the Sarbanes-Oxley Act, management is now required to report on the effectiveness of internal control and procedures for financial reporting. Additionally, the company’s auditors must attest to and report on management’s assertion about the effectiveness of those internal financial controls. Consequently, the legislation is having a profound impact on the governance and behaviour of any business with a US listing.

In the UK, over the last nine months there has been a dramatic increase in the focus on Sarbanes-Oxley compliance programmes. Despite the additional 12-month extension (to 15 July 2006) for foreign filers, announced in March 2005 by the Securities and Exchange Commission (SEC), many companies are finding that the cost of compliance is over 60 per cent higher than they estimated.

The SEC’s ex-chairman, William H. Donaldson, recently expressed his views regarding the cost of implementing Sarbanes Oxley compliance stating that, “Some of this may be attributed to one-time start-up expenses as many companies, for the first time, rigorously and systematically documented and tested their internal controls. However, we are also aware that some costs may have been due to excessive or duplicated effort by management and auditors. This may have been driven by lack of a clear risk-based focus by participants in the process.”

Sarbanes-Oxley is flexible and adaptable. That is where the difficulty lies, most business project offices run change programs built around a rigid structure involving resources, cost and time, all of which are built into the project plan that is continually under review, with decisions being made as a result of progress achieved to date. Until the end of 2005, the flexibility of companies running a Sarbanes-Oxley programme will really be tested. Not only are many of these programmes now beginning to enter the ‘business as usual’ stage, bringing with it all the complexity of knowledge transfer from the project team to the mainstream business and planning on going testing and remediation. This is now also happening against a backdrop of personnel change within the SEC.

With the departure of William Donaldson in May this year, President Bush named the Republican congressman, Christopher Cross, as the new SEC chairman. As a champion of free enterprise, many are expecting a more laissez-faire approach to corporate compliance. How much of this anticipated change of direction will result in the erosion of legislation, such as Sarbanes-Oxley, is difficult to say at this point.