The Value Proposition: There's More to Sarbanes-Oxley Compliance Than Meets the Eye
For most large companies, the setup work to comply with the Sarbanes-Oxley Act is history. While no one says the process was easy or cheap, some companies are seeing added benefits from the enormous compliance effort. For them, Sarbanes-Oxley improved decision making, provided process efficiencies and instilled greater confidence in financial reporting. While these benefits balance some of the costs, they remain difficult to quantify. With studies showing that well-governed companies pay off handsomely for shareholders, CPAs can help their employers benefit from the lessons learned by companies that approached Sarbanes-Oxley compliance as a stepping-stone to more comprehensive improvements. These entities upgraded technology and business processes and took the opportunity to change how the company functioned; new methods of doing business frequently result in cost savings. While management and audit executives' crystal balls don't yet clearly show that the cost savings balance the full cost of compliance, the excitement around possibilities for the future is palpable. AUDIT COMMITTEE CONFIDENCE As the surveys accumulated by Institutional Shareholder Services show (see "Sarbanes-Oxley Payback," page 78), many managers and directors see Sarbanes-Oxley as a positive experience. The company-wide review of processes and the required documentation increased internal transparency and provided a common language for employees in diverse departments and functions. CPAs looking to add value to the extra hours of work should help their companies realize the benefits of formalizing process documentation. Companies can find additional uses for Sarbanes-Oxley documentation as a tool for audit committees, a way to enhance employee decisions based on cross-function process information and a means of increasing efficiencies by eliminating duplicate controls. As did the majority of respondents in the surveys, the board of Little Rock, Ark.-based Alltel Corp. found Sarbanes-Oxley created useful tools. Alltell documented 100 company processes within the scope of the act. Brandi Joplin, CPA, vice-president of internal audit, led the team that mapped out the key areas in each process such as purchasing or payables. "We were early COSO adopters in 1992 and always believed we had strong internal controls," Joplin says. "But we found consistent process documentation of the controls across the entire company created even greater value." CPAs and internal auditors who now report directly to the board of directors audit committee can use the section 404 documentation as a basis for discussion. Alltel's internal audit team reports to the company's audit committee. Its process documentation includes six flowcharts per process, supported by memos and narratives. The audit committee can use this information to support its decisions. "It can look across business cycles and drill down into various processes," Joplin says. "Committee members now have insight into what's really going on and the information they need to ask very specific questions." Similarly the audit committee at global energy company USEC Inc. focuses on the broader goal of good corporate governance resulting from Sarbanes-Oxley compliance. From the beginning USEC internal audit and senior management focused beyond compliance to the value proposition Sarbanes-Oxley represented. CPAs can follow USEC's five-step process in exhibit 1, page 79. According to Barry Mumford, CPA, CMA, director of auditing for USEC in Bethesda, Md., while section 404 compliance means financial reporting should be more reliable, the broader definition of "internal control" includes two other elements: the effectiveness and efficiency of operations, and compliance with applicable laws and regulations. Together they make up the full value proposition. "Many companies are focused on reliable financial reporting," he says, "but in our opinion addressing only one of the three elements leaves most of the value on the table. …