# Presentation: 002432

## 

SOX: What is it, where did it come from, and what is happening now 

Washington Tri-Cities Chapter of the IMA
December 12, 2006

Steven Bean
Senior Manager, Protiviti

***SOX: What is it, where did it come from, and what is happening now***
- Washington Tri-Cities Chapter of the IMA
- December 12, 2006
- Steven Bean
- Senior Manager, Protiviti

## Agenda

- Introduction
- Overview of SOX Requirements
- Overview of Year 1 Compliance Efforts
- Lessons Learned
- SOX Methodology Overview (appendix)
- Q & A

## Who is Protiviti?

- Protiviti is focused solely on internal audit, technology consulting, business risk consulting and corporate governance.
- We currently have over 2,200 professionals worldwide in over 50 offices.
- Protiviti owns the intellectual capital – training, methodology and tools – developed by these professionals over the past 16 years.
- Our parent company, Robert Half International (RHI), formed Protiviti in May 2002 by hiring over 700 "Big 5" professionals, including over 50 partners, with significant internal audit and risk consulting experience.
- Locally, we have an office of 45 professionals, each with SOX, internal audit, and/or technology risk consulting experience.

_**Our Vision**_
- To be recognized as the premier global risk consulting and internal audit services company in the world.
_**Our Mission**_
- To constantly improve how businesses manage risk.  We will develop deep competency in people that enhances their value.  We will bring unparalleled expertise to clients in risk management.
_**Our Values**_
- Professionalism
- Productiviti
- Proactiviti
- Objectiviti
- Creativiti
- Integriti

## Overview of SOX Requirements

## Why the Legislation?

- A quick look at the major headlines during 2001 and 2002 tells the tale of a crisis in the making:
- Nov. 8, 2001 - **Enron** restates earnings for past five years, reports $586 million in losses
- March 27, 2002 - **Adelphia** says $2.3 billion borrowed by Rigas family not on books
- June 4, 2002 - **Tyco** CEO indicted on tax evasion charges
- June 12, 2002 - **ImClone **CEO Samuel Waksal arrested on insider trading charges
- June 25, 2002 - **WorldCom** admits to inflating earnings by $3.8 billion
- It should come as no surprise that our elected officials and the SEC would aggressively pursue correction of the problem – and pursue it they certainly did!

## Sarbanes-Oxley Act of 2002

**Section 301:**  Publicly traded companies are required to establish a procedure for the confidential, anonymous submission by employees of concerns regarding questionable accounting or auditing matters (known as "whistleblower").
**Section 302:**  Management must evaluate the design and operational effectiveness of its disclosure controls and procedures quarterly (disclosure controls include internal controls) [known as "certification"].
**Section 404:**  Management is required to file an internal control report with their annual report, stating:
- Management’s responsibilities to establish and maintain adequate internal controls and procedures for financial reporting
- Management’s conclusion on the effectiveness of these internal controls at year end
- That the company’s public accountant has attested to and reported on management’s evaluation of internal controls over financial reporting
**Section 906:**  Expressly imposes criminal penalties if the information contained in the periodic report does not fairly represent, in all material respects, the financial condition and results of the operations of the issuer.

## Sarbanes-Oxley Act of 2002

- Some Harsh Realities
- Sarbanes-Oxley requires documentation of all key business processes and primary controls within those business processes
- Sarbanes-Oxley requires testing of these controls – both by management and then again by the external auditor
- This is not going away anytime soon.  This is not a “once and done” exercise.  The Sarbanes-Oxley program should be performed with a long-term vision in mind.
- “Project” vs. “Process” mentality (will talk about this towards the end of the day)
- This exercise costs a lot of time and money

## Overview of Year 1 Compliance Efforts

##  SOX Year 1 Compliance – Overview

- SOX is the **most sweeping U.S. securities legislation** since the Securities Act of 1933 and the Securities Exchange Act of 1934.
- Estimates of the **total cost** to U.S. companies for SOX compliance in 2004 are **in excess of $35 billion**.
- The legislation is "**here to stay**" even if modified in the future as a result of current SEC roundtable meetings and other discussions.
- As of March 16, 2005, **11% of filers had reported material weaknesses **under provisions of the Sarbanes-Oxley Act.
- Overall, **stocks on filers reporting material weaknesses did decrease slightly, **however, only around 2% to 4% (small cap companies were more affected than larger cap).
- The following slides are highlights from a study by the Corporate Executive Board, entitled "SOX 404 Triggering Delayed Filings And CFO Turnover," which include some interesting results from Year 1.

## Year 1 Compliance – Overall Cost

- The study at left highlights the average Year 1 resources spent on SOX compliance (Section 404).
- The analysis suggests for a company with $250 million in Revenues, the cost of Year 1 compliance averaged $475k.

## Reporting Deficiencies

- An internal control deficiency that adversely affects the company’s ability to initiate, record, process or report external financial data reliably in accordance with GAAP.
- Could be a single deficiency or a combination of deficiencies that results in more than a _remote__ __likelihood_ that a misstatement of the annual or interim financial statements that is more than _inconsequential_ in amount will not be prevented or detected.
**Material weakness:**
- A significant deficiency that, by itself, or in combination with other significant deficiencies, results in _more than a remote likelihood_ that a _material misstatement_ of the annual or interim financial statements will not be prevented or detected.
**Material Weakness = Adverse Opinion**

## Reporting Deficiencies

- A sample framework for classifying deficiencies using the “likelihood” and “magnitude” factors:

***REMOTE ***
**(A “slight” chance or a**
**less than a 5% to 10% chance))**

***MORE THAN REMOTE ***
**(More than a **
**5% to 10% chance)**

***LIKELIHOOD***

***MAGNITUDE***

***MATERIAL AMOUNT***
**(GREATER than **
**4% to 5% of pre-tax income)**

**MORE THAN **
**INCONSEQUENTIAL **
**(i.e., More Than Clearly **
**Immaterial), But Less **
**Than Material Amount**
** ****(GREATER than .5 to 1% of **
**pre-tax income but LESS than 4%)**

**INCONSEQUENTIAL **
**AMOUNT **
**(i.e., Clearly Immaterial)**
** ****(LESS than .5% to 1% **
**of pre-tax income)**

**Control Deficiency **
**but not Significant Deficiency**

**Control Deficiency, **
**but not Significant Deficiency**

**Control Deficiency **
**but not Significant Deficiency**

**Control Deficiency **
**but not Significant Deficiency**

**Material Weakness**

**Significant Deficiency **
**but not Material Weakness**

## Filers Reporting Material Weaknesses

- 11% of accelerated filers to date (March 16, 2005) have disclosed a material weakness in internal controls.
- While the largest number of weaknesses are in financial processes and procedures, market reaction is more pronounced for disclosures related to personnel and tax accounting issues.
- As of April 2005, the number of companies receiving “adverse opinions” or disclaimers was 9.8%.

##  Compliance Week – April 2005 Overview

- Based on 2005 disclosures, the following areas were commonly cited as having known deficiencies:
**Lease Accounting**
**Accounting Policies and Practices **
**Inexperienced Staff or Lack Thereof **
**Taxes**
**GAAP Calculations and Policies**
**Revenue Recognition **
**Monitoring **
**Third-Party Relationship** (e.g., strategic supplier relationship, etc.)
**International and Merger and Acquisitions **
**Control Environment** (e.g., integrity, ethical values, compliance with Code of Ethics, etc.)

##  Compliance Week – April 2005 Overview

- The top five industries with the highest failure rate (at least 20 filings) included:
- Retail (21.5%)
- Consumer Products (20%)
- Metals and Mining (17.2%)
- Business Services (14.4%)
- Consumer Products Manufacturers (13.7%)

## Lessons Learned

## Management Best Practices

**Top management support is vital**; the project can’t succeed without it
**Budget for it and commit – be serious and set the tone:**
- Don’t ignore the clock – this is a BIG effort
- FEI studies report an under-estimation of overall effort
**Start as early as you can**
**Take charge – some common pitfalls to avoid: **
- Project is managed at too low a level within the organization
- Project team gets lost in irrelevant details
- Key scoping decisions remain unaddressed too long
**Walk through the major processes yourself**
**Insist on status reports**
**Obtain sub-certification by others**
**Communicate up, down and across the organization**
**Establish a Steering Committee to maintain senior management sponsorship **

## Potential Obstacles / "Nightmares"

- Company or external auditor **testing of remediated controls** prove they are not working
**"New scope" items** created by external auditor
**No time left** to remediate issues
**Fraud occurs**, not contemplated by existing controls
- Key **fourth quarter or annual controls** do not work
- Large financial statement adjustment **NOT detected by management**
- Large financial statement adjustment detected by management but **affecting prior quarters**
**Audit Committee** is deemed **ineffective**
- Fraud programs and controls not thoroughly documented
- Issues in **general IT control environment**
**Sample sizes** not large enough
**Deficiency / material weaknesses definition disagreements**
- SAS 70 issues

## Where are we trying to go?

## SOX Methodology Overview (appendix)

## Detailed Project Steps

| Set Foundation |
| --- |
| Organize project
Develop project plan
Agree on approach / reporting requirements |

| PHASE I: Assess Current State and Identify Relevant Processes |
| --- |
| Perform entity-level controls assessment
Select financial statement elements,  processes and locations
Agree on documentation standards –  level of depth, assertions and control objectives
Inventory existing control documentation |

| PHASE II: Document Design and Evaluate Critical Processes and Controls |
| --- |
| Document processes
Source risks (what can go wrong?)
Document controls
Assess design
Develop testing approach
Validate operation  |

| PHASE III: Design Solutions for Control Gaps |
| --- |
| Evaluate nature of identified deficiencies
Determine deficiencies requiring correction
Design and document improvements |

| PHASE IV: Implement Solutions for Control Gaps |
| --- |
| Build improvements
Implement improvements
Test improvements
Update policies and procedures
Provide training
Measure performance |

| Report |
| --- |
| Formulate conclusions with respect to internal controls over reliability of financial reporting 
Provide results and documentation to External Auditors for attestation process
Conclude attestation process
Generate internal controls report |

** ****Checkpoint with External Auditors**

## Type / Depth of Documentation

*Process Categorization Framework*

- SAMPLE

## Sample Documentation

_***Level 3 – Process Map***_

- SAMPLE

## Sample Risk / Control Matrix

- COSO Assertions:
- Existence (EX) - Assets, liabilities, and ownership interests exist as a point in time.
- Occurrence (OC) - Recorded transactions represent economic events that actually occurred during a stated period of time.
- Completeness (CO) - All transactions and other events and circumstances that occurred during a specified period, and should have been recognized in that period, have, in fact, been recorded.  Therefore, there are no unrecorded assets, liabilities,  or transactions and no omitted disclosures.
- Rights and Obligations (RO) - Assets and liabilities reported on the balance sheet are bona fide rights and obligations of the entity as of that point in time.
- Valuation or Allocation (VA) - Assets, liabilities, revenues, and expenses are recorded at appropriate amounts in accordance with relevant accounting principles.
- Presentation and Disclosure (PD) - Items in the statements are properly described and classified as well as fairly presented.

- Process:   Close the books
- COSO Objective:  Integrity of financial reporting
- Financial Reporting Element:  All financial reporting elements

- SAMPLE