| EXECUTIVE
SUMMARY |
 CPAs CAN PROVIDE A VALUABLE
service to their employers or
clients by helping them plan their
strategic approach to compliance with
section 404 of the Sarbanes-Oxley Act of
2002.
NEW SOFTWARE PRODUCTS CAN
IMPROVE corporate governance
and external communications about
financial performance. They also can
enhance the efficiency and effectiveness
of compliance programs, thus reducing
their cost and helping companies track
progress toward establishing adequate
internal controls and maintaining their
effectiveness as business conditions
change.
IT’S IMPORTANT THAT CPAs
BECOME FAMILIAR with the four
categories of software tools: “generic”
applications that enhance controls;
document management and workflow; data
mining, file retrieval, pattern
recognition and business intelligence;
and business performance management and
real-time compliance.
COMPANIES SHOULD
DETERMINE which of the four
categories of tools their current
internal controls fit into, then
identify company resources—such as staff
and funding—that are available for an
upgrade. Next they should select
advanced tools that will enhance
controls and improve company monitoring
of them and compliance reporting to
regulators.
CPAs SHOULD MAKE CERTAIN
THAT BEFORE their employers
or clients buy compliance software they
not only understand its characteristics,
limitations and the related vendor
support plans but also know what
additional tools are necessary to ensure
the company has in place a system of
mature internal controls. |
| BRUCE I. WINTERS, CPA,
is a certified information systems auditor
focusing on Sarbanes-Oxley engagements in
PricewaterhouseCoopers’ systems and
process assurance practice. He welcomes
comments on this article and can be
reached by e-mail at
bruce.i.winters@us.pwc.com .
|
 ime is running out for many
businesses to begin the complex process of
complying with section 404 of the Sarbanes-Oxley
Act of 2002, which tightened internal control and
financial reporting requirements. (See “ Impact of Section 404 .”)
This article is intended for readers in both
industry and public accounting who seek, or need
to offer, advice on selecting software—based on
the extent to which a company already has
compliance systems in place—for meeting section
404’s requirements. Although it is not a detailed
buyer’s guide, it describes the features of
specific software categories and thus can serve as
a practical guide to what’s available in the
market and what to look for when examining
software for employers and clients and discussing
products with vendors. | CPAs can play a
valuable role in helping companies choose
software tools whose functions include
supporting compliance and also enhancing
communication with investors, employees
and regulators, making financial
statements clear and easier to analyze and
increasing efficiency by, for example,
eliminating redundant or obsolete controls
and improving workflow. Acting as a
technical adviser on financial internal
controls design, financial processes and
transaction flows, the CPA can help a
client or employer answer three difficult
but important questions:
 Is it better to design a
compliance program for the short term
(one year or less) or a more sustainable
one for the long term? |
|
They Aim to Do It for
Less
| Emphasis on
cutting Sarbanes-Oxley
compliance costs in
2004 |
Percentage of
responding CFOs
| | Major
| 23% |
| Moderate |
50 |
| Limited |
13 |
| None | 7
| | Not
sure | 7
|
Source: Survey of CFOs of
70 U.S. companies with an
average annual revenue greater
than $6 billion,
PricewaterhouseCoopers, 2003.
| |
Which software tools are most capable
of fostering complete, effective and sustainable
compliance in a given business situation?
What other investments (new policies
and procedures, training and ethics programs, for
example) are necessary to achieve section 404
compliance and also to take full advantage of the
software chosen?
| CPAs can play a
valuable role in helping companies
choose software tools whose functions
include supporting compliance and also
enhancing communication with investors,
employees and regulators, making
financial statements clear and easier to
analyze and increasing efficiency.
|
Companies are eager to contain the already
spiraling costs of complying with Sarbanes-Oxley.
Some are overhauling their business processes and
integrating them into enterprise-wide systems.
They also are installing software that produces
always-up-to-date business process documentation
in terms managers, investors and lenders can
understand. This software enables companies to
refine their financial controls, improve both
their timing and public communication of key
company events and provide more detailed
evaluations of business results. ASK (AND
UNDERSTAND) BEFORE BUYING
CPAs can save clients or
employers time and money by strongly
recommending the selection of software be
based on the criteria listed below in
order of importance.
The software tool’s most
important functions, not its minor
features.
The vendor’s viability as a
going concern.
The vendor’s support plans
and the software’s position in its
product line.
The product’s ongoing
compatibility with the company’s
operating systems and its scalability.
Whether the tool has a
Web-based interface and employees can
access it online without installing
software on their individual PCs.
Whether customization of
the product is available or required.
The availability of
suitable vendor-supplied implementation
services.
The level of training the
vendor provides.
The extent of integration
with other tools—for example, how
proprietary is the database, and can
users easily link it to other programs?
Price. | |
Maintenance, support and upgrade
costs (direct and indirect—for example, hardware
and staff).
Availability of information on any
infrastructure and operating system changes or
updates that could become necessary.
BUYER, KNOW THYSELF
The extent to which a
company has progressed in building a
strong control environment will dictate
what tools it needs to buy and when. CPAs
can use an internal controls maturity
framework to help companies determine
whether their existing or proposed
controls for a given activity or process
are rigorous enough to manage related
risks and that they are sufficiently
documented for review by auditors who must
assess section 404 compliance. A version
of such a framework, developed by
PricewaterhouseCoopers, appears below.
As companies implement tools capable
of providing real-time updates of
business-process changes, their systems
will begin to resemble the
higher-numbered descriptions in the
maturity model, reflecting greater
efficiency and reduced risk.
Here’s how to use the model. First,
the CPA and the company should review
the company’s existing controls and
identify the level of maturity that best
describes them. This comparison will
highlight any less than optimal
controls, reveal what additional levels
of sophistication are possible and
enable the company to decide what goals
it wants to establish for reinforcing
its controls.
The Maturity Framework
Level 1: Unreliable.
Unpredictable environment
for which controls have not been
designed or implemented. |
|
Impact
of
Section 404
This section of the
Sarbanes-Oxley Act of 2002
generally requires public
companies with a market value
of $75 million or more,
following the conclusion of
their first fiscal year ending
on or after June 15, 2004, to
begin certain actions—such as
including in their annual
reports an assessment of
whether their systems and
financial reporting procedures
are capable of providing
accurate and complete
financial statements. Other
businesses must start their
compliance efforts after the
close of their first fiscal
year ending on or after April
15, 2005. Section 404
directs the SEC to issue rules
mandating that companies’
annual reports contain an
internal control report that
States the
responsibility of management
for establishing and
maintaining an adequate
internal control structure and
procedures for financial
reporting.
Contains an
assessment, as of the end of
the company’s most recent
fiscal year, of the
effectiveness of its internal
control structure and
procedures for financial
reporting.
| |
Level 2: Informal.
Controls are present but
inadequately documented and largely dependent on
manual intervention. There are no formal
communications or training programs related to the
controls.
Level 3: Standardized.
Controls are in place and
documented, and employees have received formal
communications about them. Undetected deviations
from controls may occur.
Level 4: Monitored.
Standardized controls are in place
and undergo periodic testing to evaluate their
design and operation; test results are
communicated to management. Limited use of
automated tools may support controls.
Level 5: Optimized. An
integrated internal controls framework with
real-time monitoring by management is in place to
implement continuous improvement. Automated
processes and tools support the controls and
enable the organization to quickly change the
controls as necessary.
BE THOROUGH
Given the constant evolution of
business processes, it makes sense for companies
to adopt—if they’re not already using—compliance
software that can be fully integrated with company
operations and reporting. Yet many companies still
use paper-based systems or relatively
uncomplicated software—such as spreadsheet,
word-processing and flowchart programs—to document
their business process controls for compliance
purposes. But while these products and paper
systems can produce initial documentation easily,
they aren’t well-suited to continually making or
tracking changes in it. Companies
reluctant to implement more complex systems
equipped to track business process changes over
time argue that Sarbanes-Oxley guidance and
requirements still are not final, making
significant software expenditures premature.
Postponing the purchase of appropriate tools,
however, may require the company to create
compliance documentation using spreadsheets and
word-processing programs, which can be
error-prone. But eventually—perhaps very soon—they
will have to recreate that documentation with more
robust tools. Many executives are reaching
the same conclusion. In a CFO magazine
survey published in March 2003, only 11% of 245
CFOs said spreadsheet-based control
reporting—which is very common—was accurate enough
to make senior executives confident about
certifying their companies’ financial statement
data, as the Sarbanes-Oxley Act requires.
To help guide their employers and clients in
choosing the right application to facilitate
section 404 compliance, CPAs first need to explore
the characteristics and relative merits of several
types of software tools.
WHAT TOOLS ARE AVAILABLE
Many of today’s commercial software products
can help companies comply with the provisions of
the Sarbanes-Oxley Act. These tools range from
simple, stand-alone programs that focus on a
specific issue (for example, a regulatory
checklist) to more complex enterprise-wide,
real-time systems. Except for generic
tools—discussed below—many of these products
provide a framework for adding modules to be
offered in the near future—even by other vendors.
The best of them establish and maintain a
relationship between the overall business and its
core systems and provide an internal control
architecture that changes to meet the
organization’s evolving compliance needs.
CPAs should encourage their clients and
employers to speak with multiple vendors when
evaluating tools and request demonstrations of
them to ensure understanding of their potential
value to the company. The tools can be
classified into four categories.
Generic tools enable users
to document internal controls, reduce potential
risks and provide some level of comfort that
compliance initiatives are in place. Many
companies already have such compliance software
built into their general accounting systems (see
exhibit 1 ). But since such software is
not dynamic—that is, it can’t easily adjust to a
company’s changing business requirements—it
provides only the most basic level of assurance
and applies only to a given point in time.
Further, since companies often adopt such tools
without going through a formal software evaluation
process and postpurchase measurement of their use
and performance, it’s difficult to ascertain their
reliability. These generic tools help
companies comply with section 404. Their
capabilities are limited, however, and do not
match those of other products that are the best in
their respective categories. However, vendors of
accounting products are augmenting them with
self-documenting audit trails that automatically
record and provide access to incremental changes,
with analysis tools to help auditors examine
transactions within the system, with business
intelligence tools that make it possible to delve
into or summarize data, with consolidation
interfaces linking disparate accounting systems,
and with flags and alerts that signal when
predetermined cost or other limits have been
reached and require review by an analyst.
The CPA should emphasize the importance of his
or her client’s or employer’s contacting their
accounting software vendors to evaluate their
plans for assistance and support in section 404
compliance. This will provide a starting point for
their deciding what, if any, additional tools are
needed and how best to connect them to the
company’s existing systems. Besides
accounting products, other subcategories of
generic tools include those for communication and
collaboration and regulatory and technical
reference purposes (see exhibit 1 ).
Security products, of which there are too many to
mention, constitute another group of these generic
tools.
| Communication and collaboration
tools also are used to set up audit trails
and documentation. E-mail, instant
messaging, webcast conferences and virtual
team workspaces—locations employees share
for common projects—all are repositories
of critical business and process
information that organizations rely on and
must document and analyze.
Security-focused generic tools often
provide finely detailed analyses for
segregation of duties, intrusion
detection, encryption, firewall
implementation, antivirus protection,
enterprise security and disaster
recovery plan updates as important
components of a strong internal control
system. | |
Regulatory and technical reference tools
provide a strong environment for obtaining
accurate and up-to-date regulatory information for
an organization. CPAs should focus their
clients and employers—when they shop for such
tools—on the importance of obtaining from vendors
a detailed explanation of how their products might
integrate with the company’s internal control
environment and with other vendors’ tools. While
such integration is possible, it tends to be less
than optimal because generic tools are not
designed to link to other products.
Document management and workflow
tools are more capable of
interacting with other software than are generic
products and can address relatively
straightforward functions such as report tracking
(see exhibit 2 , above). These products
monitor workflows and processes—applying a
business unit’s self-defined rules—to make them
more event-driven and thus easier to manage. They
allow users to perform detailed indexing and
searching of multiple document types, including
e-mail, flowcharts and narratives, to organize and
retrieve text, images and numeric data. They also
enable companies to collect and integrate data
from their various accounting systems and to
create links between separate business units’
discrete business processes. Companies using them
can better understand and analyze the frequency of
control activities, categorize internal control
types, test their effectiveness and reveal
relationships between key job responsibilities and
their place in the workflow. | These tools also
are used to analyze risk and controls,
rank them in terms of importance,
materiality and impact and organize them
by work group in a way that can be
continuously updated to correspond with
changing business conditions and be
summarized for quarterly review and
management approval.
Data mining, file retrieval,
pattern recognition and business
intelligence tools can
gather data from separate systems and
organize and analyze them. This enables
companies to detect patterns in
financial statement data and thus
improve the effectiveness of internal
controls and the accuracy of financial
information (see exhibit 3 , at
right). | |
CPAs should impress upon companies the central
role that three types of software in this
group—data mining, file retrieval and pattern
recognition—play in helping organizations fully
understand the information they produce about
their activities. Tools that perform these
functions typically analyze, manipulate, sample
and extract data. They also compare actual trends
and patterns in financial statement accounts with
expected norms to help identify irregularities
that could indicate fraud or errors.
| A fourth
type of software in this group—business
intelligence tools—makes it possible to
examine the results of business
operations, delving deep into data and
modifying variables to see how they affect
a situation. It also enables users to
review data for patterns, and it has
strong reporting and graphical
capabilities. And, with the advent of
tools that are easier to connect to
financial systems, this kind of software
also has become cost-effective.
Business performance
management and real-time compliance
tools provide
management with real-time,
enterprise-wide data (see exhibit 4
). These tools can smoothly interact
with other software and systems and
provide one repository for all company
information, facilitate the development
of consistent and more efficient
processes, help optimize information
timeliness and accuracy and promptly
notify management of compliance problems
and supply the means to resolve them,
all of which enable the company to
respond quickly to changing business
conditions. The Gartner Group (
www.gartner.com ), a technology
research and consulting company,
estimates that 40% of companies will
adopt business performance management
(BPM) tools by 2005. BPM tools
add continuous auditing capability to
real-time enterprise systems in the form
of customized computer screens—called
dashboards—that present key performance
indicators managers use to decide when
and how to react to changing business
conditions. Managers’ actions might
include defining, improving and
monitoring business processes on a
timely basis, measuring and tracking the
workflow of business functions and the
changes in resources at each step of a
process and—based on these—dynamically
adjusting business processes. (An
example would be production and
inventory adjustments based on sales
trends and related changes to approvals
and workflow.) | |
There is a wide range of products in this
category. Some link to specific
enterprise-resource-planning systems, while others
perform specific functions such as setting
automatic triggers or real-time alerts to obtain
quick responses. Some BPM tools enable you to
instruct the system to alert management whenever,
for example, company sales goals are missed or
surpassed or multiple approvals are needed on
large transactions. Real-time compliance
tools store all information in one “data
warehouse,” provide consistent and efficient
processing, optimize timeliness and accuracy,
include rapid warning and response systems and
make it easier to monitor and manage risks. These
tools also provide performance management and
workflow functions. CPAs should ensure
that all products being considered serve the needs
of organizations in which employees report to a
variety of departments in different locations. The
software must link controls to processes, analyze
and describe the processes and link them to
objectives and risks. The tools also should enable
users to categorize, and set priorities for, risk
and business objectives comprehensively in all
areas of an organization. DEAL WITH
THE INEVITABLE
Sarbanes-Oxley has begun a
new era of reporting for public companies.
In order to meet the expectations of
employees, shareholders and government,
companies will need real-time systems that
inform management of changing business
conditions, such as changes in revenue,
expenses, cash flow, production and
employee-related issues as they occur.
Many companies will respond with
static, manual “quick fixes” or
patchwork solutions—such as
spreadsheet-based systems—without
lasting value, but others will build the
appropriate architecture and tools to
monitor processes and ensure their
integration into standard operations,
thereby providing the mechanisms that
ensure the reporting of complete,
accurate, valid and reliable
information. Note that this
article does not pretend to cover all
available products in any of the
software categories it discusses.
Instead, it presents a starting point
from which readers can begin their own
exploration of the subject. |
 |
PRACTICAL
TIPS TO REMEMBER
|
The CPA should
help the company evaluate its
environment to determine the
maturity level of its internal
controls.
He or she also
should assist the entity in
assessing its internal control
philosophy and control
environment.
The CPA should
encourage management to
develop an
understanding—through
discussion with vendors—of the
compliance software tools and
their characteristics.
When evaluating
such software, companies
should speak with multiple
vendors in each category and
observe a demonstration of
every product to understand
the value it can add to the
organization.
| | |
Get Clients Ready for Tax Season