# Presentation: 355314

## Washington Group InternationalSarbanes-Oxley Implementation

**Brian R. Thomas**
**Waste Treatment Plant **
**Business Services Manager**
**December 12, 2006**

## What is SOX?

## Sarbanes-Oxley Act of 2002

- Signed into law by President Bush in July 2002
- Named after its Congressional sponsors
- Senator Paul Sarbanes (D-MD)
- Congressman Michael Oxley (R- OH)
- Fundamental changes
- Independent auditing firms
- Significantly limited in what they can do on consulting side for its audit clients
- Audit engagements will no longer be a loss-leader
- Significantly higher fees for audit engagements
- Publicly-traded companies
- Criminal liability for CEO’s & CFO’s
- Response to financial scandals
- Enron, WorldCom, Adelphia, HealthSouth, others
- Restore investor confidence in publicly-traded companies

**Notes:**
Independent auditing firms
Public Company Accounting Oversight Board
Regulates; inspects; disciplinary proceedings
Now required to issue 2 audit opinions
Financial statements
Internal controls over financial reporting

Eliminated ability for auditors to provide consulting services to their audit clients

## Background

- No significant law changes since 2002
- Intense industry and lobbyist pressure on Congress and SEC to reduce requirements of Section 404
- Very costly
- Penalizes small businesses
- Discourages listing on U.S. stock exchanges
- 2005 was second year of compliance for Washington Group
- Internal controls documented and tested
- Included every business unit, numerous projects and many corporate functions
- Financial Compliance department created to accomplish task

## 2006 Update

- Further focusing/reduction of control activities
- Top-down; risk-based
- Reduced over 50% for 2005
- Additional reductions for 2006
- Project SOX checklist
- Controls performed at project level
- Tested at BU level & project level
- Process-level control activities
- 80 percent of revenue & contract earnings as measured at year-end

## Regulatory & Compliance Update

- Year 2 SOX reports from companies
- Useful to identify, document, test controls
- More top-down & risk-based
- But not to the extent expected
- Fewer key controls
- More discipline in corporate accounting practices
- Improved investor confidence
- 44%* say financial statements more reliable
- 33%* say Section 404 helped them to prevent or detect fraud
- *Financial Executives International (FEI) March 2006 Survey

## Regulatory & Compliance Update

- Year 2 SOX report from companies
- 85%* say Section 404 costs exceed benefits
- Average costs declined 16%*
- Average compliance cost- $3.8 million*
- Duplication of effort for internal & external audit
- Testing of IT controls particularly checklist oriented (not risk-based)
- *Financial Executives International (FEI) March 2006 Survey

## Costs & Benefits

- Year one implementation (2004) was expensive
- Average compliance cost was $1.9 million per billion of revenue*
- Year two costs expected to be less
- Most companies expect to spend less
- Due to regulatory guidance after year one

- *For companies with annual revenues less than $5 billion.  Source: AMR SOX Spending Survey, 11/04, Controllers’ Leadership Roundtable research.

## Costs & Benefits

- Positive impact on overall corporate governance
- Encourages management to set the “tone at the top” – walk the talk
- Reinforcement that managers at all levels are responsible for internal control
- Provides a platform to hold individuals accountable for noncompliance
- Reduces the risk of material misstatements of financial reports
- Provides an opportunity to review the company’s processes related to financial reporting
- Enhance efficiency; increase standardization; reduce errors

## Costs and Benefits

- Companies have found they didn’t always know what they thought they knew
- Investors, creditors, & other stakeholders
- Higher confidence (higher stock price, lower costs of borrowing)
- More reliable financial statements
- More informed and vigilant Board of Directors and audit committee
- More timely and better management decisions

## Audit Committee of Board of Directors

- Must be independent of company
- Has a mechanism to receive confidential and anonymous complaints
- Directly manages the activities and compensation of the independent auditors
- At least one member must be a “financial expert”
- Holds management accountable for resolving significant deficiencies and material weaknesses in internal controls
- Washington Group internal audit function reports directly to audit committee

## Principal Executive Officers

- For each quarterly & annual financial report, the CEO & CFO must certify that
- It is complete, accurate, transparent
- Internal controls over financial reporting have been established and maintained
- Effectiveness of internal controls within the past 90 days has been evaluated
- There is adequacy of disclosures to the audit committee
- Significant deficiencies & material weaknesses in internal controls
- Fraud involving management (any amount)
- There is adequacy of disclosures to the public
- All material weaknesses in internal controls over financial reporting

## Summary - Project-level SOX Requirements

- Perform SOX project control activities monthly or quarterly
- Perform quarterly self-assessment of effectiveness of SOX control activities
- Assist Corporate Audit in performing their audit work (mid-year and at year-end)
- New projects
- Prepare initial process narratives
- Augment existing procedures where needed to obtain compliance
- As the project progresses, do items 1. through 3. above
- Included are projects that comprise 80% of Company’s revenues and gross profits.

## Quarterly Controls Self-assessments

- “Process owners” perform quarterly self-assessments of SOX control activities
- Business managers at large projects, business units & corporate functions (about 50 in all)
- Process narratives – review & update, as needed
- At WTP:
- Added six SOX processes
- Added “Project CEO/CFO” sign-offs to four periodic financial support documents
- Control activities – perform inquiries, observations or other procedures to determine whether SOX control activities are being performed as designed
- Deficiencies – remediation for existing, identify & report any new
- Survey – complete & certify as to adequacy of SOX control activities
- Sign-off – OpenPages SOX Express application

## Regulatory & Compliance Update

- Restatements to correct financial statement - errors*
- Total of 1,200 for 2005
- Nearly double the rate of 2004
- 1 for every 12 U.S.-listed companies
- Of the 1200, 640 reported material weaknesses** in internal control
- Most companies that did not report material weaknesses were smaller companies that did not have SOX audits

- *Excludes GAAP-to-GAAP changes or adoption of new accounting principles
- **A deficiency in internal controls that creates a “more than remote likelihood” that a material misstatement in the financial statements will go undetected

## Restatements – U.S. Public Companies

- Companies have found they didn’t always know what they thought they knew.

## Top 6 Restatement Areas - 2005

## Summary

- Stay the path of reducing the cost of compliance
- Sustainability of SOX
- Move from project (one shot deal) mentality to a process (this is life as we know it) mentality
- Remediate deficiencies in internal controls
- Don’t expect any regulatory changes in the near-term
- Recent rash of options-backdating cases won’t help

## Summary (continued)

- Look for opportunities to focus & automate control activities
- Risk-based
- Top-down approach
- Systems work flow & imbedded controls
- Less transaction-level testing
- Our goal: no financial restatements
- Resource – AICPA.org website link:
- 	“Sarbanes-Oxley Implementation Central”
- 	“State Issues Related to the Sarbanes-Oxley Act”