# Presentation: 683945

## Institute of Management Accountants Seminar
Richland, Washington
December 12, 2006

**Richland, Washington**
**December 12, 2006**

**SOX 404 Implementation – Fluor Approach and Perspective**

## Fluor Corporation – Background

- One of the world’s largest publicly owned engineering, procurement, construction, and maintenance services companies
- Ranked #1 in *Fortune* magazine’s “Engineering, Construction” category of the largest U.S. corporations
- Ranked #169 overall of the *Fortune 500*
- Fluor’s primary objective is to develop, execute, and maintain capital projects on schedule, within budget, and with operational excellence
- Consistently rated as one of the world’s safest contractors
- Consistently rated by *Fortune* as one of “America’s Most Admired Companies” and the only U.S.-based company in the industry on the “Global Most Admired Companies” list

## Fluor Corporation – Background (cont.)

- Recently named as one of G.I. Jobs Top 50 Most Military Friendly Employers in the U.S. (#23)
- Co-leader (along with Newmont Mining and Petronas) of the World Economic Forum’s Partnering Against Corruption Initiative (PACI) for the last three years
- Signed by ~100 global companies representing over $500 billion in annual revenue
- By signing, companies commit to:
- A no-bribe policy, and
- Installing preventative systems and procedures to guard against corruption
- In addition to project offices, Fluor maintains a network of offices in more than 25 countries across 6 continents
- More than 35,000 employees worldwide
- 2005 revenues of $13.2 billion
- 2006 revenues projected to be $14 - $15 billion
- Approximately two-thirds of backlog is outside the United States

## Fluor Corporation – Background (cont.)

- Serves both government and non-government clients in a wide variety of traditional and evolving industries worldwide, including:
- Chemicals and Petrochemicals
- Commercial and Institutional
- Government (U.S. and international locations)
- Healthcare
- Life Sciences
- Manufacturing
- Microelectronics
- Mining
- Oil and Gas
- Power
- Telecommunications
- Transportation Infrastructure

## Fluor’s Sarbanes-Oxley Timeline

- December 2, 2001 		Enron files for bankruptcy 					($63.4B in assets)
- July 21, 2002			WorldCom files for bankruptcy 					($103.9B in assets)
- July 30, 2002			Sarbanes-Oxley Act signed into
- 			  	 law by President Bush
- August 2002			Fluor began to evaluate the 					ramifications of the Act
- November 2002		Fluor and its auditors (E&Y) 					began to identify in-scope 					accounts and processes for 					Section 404
- March 2003			Internal Control Steering 					Committee formed
- December 31, 2004		Initial Fluor implementation date

## Summary of Fluor’s SOX 404 Approach

## Internal Control Steering Committee

**Internal Control Steering Committee**

- CFO

**Internal Control Steering Committee**
**Gary Smalley**

**Internal Audit**

**Finance **
**Process Owner**

**IT**
**Process Owner**

**Operations**
**Process Owner**

**Ernst & Young**

## Team Members – Roles and Responsibilities

- Internal Control Steering Committee – Advise, provide guidance in interpreting requirements
- Process Owners – Update policies and procedures, flowcharts, and control analysis forms
- Optional self-testing of significant financial and business processes
- Internal Audit – Perform management testing of the design and effectiveness of internal control over financial reporting
- Ernst & Young – Independently test the design and effectiveness of the controls, and ultimately attest to effectiveness of controls and robustness of management’s evaluation process

**Notes:**
Steering Committee:  
Document Fluor’s internal control system and related work processes
Ensure the timely preparation of the required documentation
Interface with other company functions and locations to ensure an appropriate understanding and prioritization of implementation activities
Assess the adequacy of internal controls and address perceived or known weaknesses

Self assessment tests for the design of the controls (preventative controls, detective controls)
All weaknesses (design or effectiveness) must be identified and remediated
Extent of the weakness is determined by the materiality (Recordable, Significant, or Material)

## Scope Determination and Documentation

- Determine Significant Financial Accounts
- Income Statement and Balance Sheet accounts reviewed
- Accounts selected based on materiality
- Determine Significant Processes
- Finance, IT, and Operations (e.g., project controls, subcontracting, procurement) processes considered
- Determine Significant Locations
- Revenues, Project Gross Margin, and Assets are factors considered
- Major office locations plus large standalone projects
- Locations that comprise 65-70% coverage of above three categories are subjected to detail testing (Tier 1 locations)
- Determine Significant Processes for each Location
- Prepare / Validate Documentation for each Location
- Policies and Procedures, Flowcharts / Narratives, Control Analysis Forms
- Software tool selected to house and manage documentation and test work

## Examples of Fluor Significant Processes

- Finance
- Billing
- Cash Receipts
- Accounts Payable
- Payroll
- Revenue Recognition
- Financial Statement Close
- IT
- Application Security
- Backup and Recovery
- Change Management
- Network and Platform Security
- Physical and Environmental Security
- System Management

## Examples of Significant Processes (cont.)

- Operations
- Project Controls
- Proposal Estimating
- Project Forecast
- Change Management
- Contingency
- Subcontract Commitments
- Purchase Order Commitments

## Documentation and Testing by Tier

- All Fluor offices and standalone projects are classified as either Tier 1, 2, 3 or 4 based on financial significance of Revenues, Project Gross Margin (PGM) and Assets
- Tier 1 locations total ~ 65 -70% of revenues, PGM and assets
- Tier 2 locations total ~ 10-15% of revenues, PGM and assets
- Tier 3 locations total ~ 10-15% of revenues, PGM and assets
- Tier 4 locations total < 5% of revenues, PGM and assets
- The following summarizes the level of documentation and testing performed for the various tier classifications:

| Classification | Documentation | Detailed Testing | Management Self Assessment (MSA) |
| --- | --- | --- | --- |
| Tier 1 | Yes | Yes | Yes |
| Tier 2 | Yes | No | Yes |
| Tier 3 | No | No | Yes |
| Tier 4 | No | No | No |

## Internal and External Audit Testing

- Internal Audit (detailed) testing at Tier 1 locations
- Interim testing (Q2 / early Q3)
- Roll Forward testing (early Q4)
- Testing of Management Self Assessments (MSA’s) (Q3 / Q4)
- External Audit Testing at Tier 1 locations
- Interim testing (late Q2 / Q3)
- Roll Forward testing (Q4)
- MSA testing (Q4)
- Management Self Assessments completed by Tier 2 and 3 locations
- Tested by Internal Audit and External Audit (Q3 / Q4)
- Entity Level Questionnaires completed by selected employees
- Tested by Internal Audit and External Audit (Q3 / Q4)
- Vast majority of deficiencies are identified by Internal Audit and remediated prior to testing by External Audit and prior to year end

## Key Success Factors for Fluor

- Started early
- Executive management support (Tone at the Top)
- “Zero Tolerance” approach communicated by management resulted in issues identified being resolved quickly
- Involved external auditors from the beginning and throughout the process
- Recognized the impact of IT processes on ICFR from the outset
- Timely and effective communications to the organization
- Teamwork among the various groups
- Acceptance of responsibilities by process owners
- Mature, control conscious, functional organizations accustomed to structured processes
- Approach and roll-out plan were continuously monitored and re-validated by the Internal Control Steering Committee
- Progress and approach benchmarked with other companies – both within the industry and others

## Improvements Made since 2004

- Continued periodic communications, emphasizing need to comply and reduce the number of deficiencies, which has:
- Made SOX 404 compliance more of a habit than an effort (i.e., part of the Company’s “DNA”)
- Fewer deficiencies translated into reduced remediation effort / costs
- Fewer deficiencies resulted in reduced internal and external time / cost of re-testing
- Simplified documentation to focus only on testable controls
- Reduced the number of processes by combining related processes and controls
- Eliminated testing of some lower risk controls (over-tested in 2004)
- Simplified and clarified test procedures
- Worked closely with external auditors to identify efficiencies in testing approach and increase reliance on Internal Audit testing
- Reduced reliance on outside consultants

## Selected SOX 404 Statistics

|  | 
2006 | 
2005 | 
2004 |
| --- | --- | --- | --- |
| Open Deficiencies at Year End
 | TBD
 | 16 | 31 |
| % Decrease in Total Deficiencies (from prior year) | 44%*
 | 42% | -- |
| % Decrease in Internal Audit Testing Hours (from prior year) | 5%* | 32% | -- |
| % Decrease in Consultant Costs (from prior year)
 | 5%* | 63% | -- |

- * Projected

## Continuing SOX 404 Challenges

- Ensuring that internal control improvements remain in place
- Keeping internal auditors interested in performing SOX 404 testing
- Continue to look for ways to improve efficiencies and reduce effort
- Evaluate impact of upcoming revisions of AS 2 of the PCAOB