How To Get Started with your IT Compliance Efforts for SOX

There’s no question about it. For many of you top executives in the corporate world, all roads leading to a brighter future have to go through SOX compliance. And because the business processes that contribute to financial reporting (the crux of the Sarbanes-Oxley Act) are now highly reliant on IT systems, it is important to focus a good part of your attention there.

It is a long and arduous path to IT compliance, so if you don’t want your company to fall by the wayside due to inefficient utilisation of resources, it is important to set out with a plan on hand. What we have here are some vital information that will guide you in putting together a sound plan for SOX compliance of your company?s IT systems.

Why focus on IT systems for SOX compliance?

We’ll get to that. But first, let’s take up the specific portions of the Sarbanes-Oxley Act that affect information technology. These portions can be found in Section 302 and Section 404 of the act.

In simplified form, Section 302 grants the SEC (Securities and Exchange Commission) authority to come up with rules requiring you, CEOs and CFOs, to certify in each annual or quarterly financial report the following:

  • that you have reviewed the report;
  • that based on your knowledge, the report does not contain anything or leave out anything that would render it misleading;
  • that based on your knowledge, all financial information in the report fairly represent the financial conditions of the company;
  • that you are responsible for establishing internal controls over financial reporting; and
  • that you have assessed the effectiveness of the internal controls.

Similarly, Section 404, stated in simplified form, allows the SEC to come up with rules requiring you, CEOs and CFOs, to add an internal control report to each annual financial report stating that you are responsible for establishing internal controls over financial reporting.

You are also required to assess the effectiveness of those controls and to have a public accounting firm to attest to your assessment based upon standards adopted by the Public Company Accounting Oversight Board (PCAOB).

While there is no mention of IT systems, IT systems now play a significant role in financial reporting. Practically all of the data you need for your financial reports are stored, retrieved and processed on IT systems, so you really have to include them in your SOX compliance initiatives and establish controls on them.

Now that that’s settled, your next question could very well be: How do you know what controls to install and whether those controls are already sufficient to achieve compliance?

Finding a suitable guide for IT compliance

The two bodies responsible for setting rules and standards dealing with SOX, SEC and PCAOB, point to a well-established control framework for guidance – COSO. This framework was drafted by the Committee of Sponsoring Organisations of the Treadway Commission (COSO) and is the most widely accepted control framework in the business world.

However, while COSO is a tested and proven framework, it is more suitable for general controls. What we recommend is a widely-used control framework that aligns well with COSO but also caters to the more technical features and issues that come with IT systems.

Taking into consideration those qualifiers, we recommend COBIT. COBIT features a well thought out collection of IT-related control objectives grouped into four domains: Plan and Organise (PO), Acquire and Implement (AI), Deliver and Support (DS), and Monitor and Evaluate (ME). The document also includes maturity models, performance goals and metrics, and activity goals.

A few examples of COBIt’s detailed control objectives are:

DS4.2 – IT Continuity Plans
DS4.9 – Offsite Backup Storage
DS5.4 – User Account Management
DS5.8 – Cryptographic Key Management
DS5.10 – Network Security
DS5.11 – Exchange of Sensitive Data

By those titles alone, you can see that the framework is specifically designed for IT. But the document is quite extensive and, chances are, you won’t need all of the items detailed there. Furthermore, don’t expect COBIT to specify a control solution controls for every control objective. For example, throughout the control objective DS4 (Ensure Continuous Service), you won’t find any mention of virtualisation, which is common in any modern business continuity solution.

Basically, COBIT will tell you what you need to attain in order to achieve effective governance, management and control, but you’ll have to pick the solution best suited to reach that level of attainment.

Articles highly relevant to the one you just read:

Month End Accounting The Way It Should Be Today
Spreadsheet Woes ? Burden in SOX Compliance and Other Regulations
Spreadsheet Woes ? Limited Features For Easy Adoption of a Control Framework
How Internal Auditors Can Win The War Against Spreadsheet Fraud

Check our similar posts

Matrix Management: Benefits and Pitfalls

Matrix management brings together managers and employees from different departments to collaborate with each other towards the accomplishment of the organizational goals. As much as it is beneficial, matrix management also has limitations. Hence, companies should understand its benefits and pitfalls before implementing this management technique.

Benefits

The following are some of the advantages of matrix management:

Effective Communication of Information

Because of the hybrid nature of the matrix structure, it enables different departments to closely work together and communicate frequently in order to solve project issues. This leads to a proficient information exchange among leaders and subordinates. Consequently, it results to developed strategies, enhanced performance and quick productivity.

Efficient Use of Resources

Resources can be used efficiently in the organisation since it can be shared among functions and projects. As the communication line is more open, the valuable knowledge and highly skilled resources are easily distributed within the organisation.

Increased Motivation

The matrix structure promotes democracy. And with the employees working on a team, they are motivated to perform their duties better. The opinions and expertise of the employees are brought to the table and considered by the managers before they make decisions. This leads to employee satisfaction, empowerment and improved performance.

Flexibility

Since the employees communicate with each other more frequently, decision making becomes speedy and response is adaptive. They can easily adjust with diverse situations that the company encounters.

Skills Development

Matrix employees are pooled out for work assignments, even to projects that are not necessarily in line with their skill background. With this approach to management, employees have the chance to widen their skills and expertise.

Discipline Retention

One significant advantage of matrix management is that it enables the employees to maintain their skills in functional areas while working with multidisciplinary projects. Once the project is completed and the team wraps up, the members remain sharp in their discipline technically and return to their home functions.

Pitfalls

Here are some disadvantages of matrix management:

Power Struggle

In the matrix structure, there is always tension between the functional and project manager. Although their intent is polite, their conflicting demands and competition for control over the same resources make it more difficult.

Internal Complexity

Having more than one manager, the employees might become confused to who their immediate leader is. The dual authority can lead to internal complexity and possible communication problems. Worst, employee dissatisfaction and high employee turnover.

Heightened Conflict

In any given situation where people and resources are shared across projects, there would always be competition and conflict. When these issues are prolonged, conflicts will heightened and will lead to more internal problems.

Increased Stress

For the employees, being part of a matrix structure can be stressful. Their commitment is divided among the projects and their relationship with multiple managers requires various adjustments. Increased stress can negatively affect their performance in the long run.

Excessive Overhead Expenses

Overhead administrative costs, such as salaries, increase in a matrix structure. More expenses, more burden to the organisation. This is a challenge to matrix management that leaders should consider carefully.

These are just some of the advantages and disadvantages of matrix management. The list could go on, depending on the unique circumstances that organisations have. The key is that when you decide to implement matrix management, you should recognise how to take full advantage of its benefits and understand how to lessen, if not eradicate, the pitfalls of this approach to management.

Fine-tuning your Operations and keeping our staff Happy with FieldElite

They are the engine that drives your operations, but are you really giving you value for your money? How much time is spent by your personnel on lengthy paperwork and record-keeping, as opposed to actually providing the service to your customers? Manual tasks create bottlenecks and slow your operations, which in turn affects service delivery and customer satisfaction. You want to reach more clients and boost your brand image, growing your market share and generating more revenue. Field Service Management (FSM) software comes in optimise the operations of your mobile workforce, cut down resource wastage, and enhance your productivity as a firm, by actually enabling your field staff to get more done, thus achieving their individual goals. In fact, according to a report published by Fortune Business Insights?, the global FSM market- which stood at $2.29 billion as recently as 2018, will have expanded to $7.27 billion by 2026. What does this mean for your employees, and how do they benefit from FieldElite?

  • Skipping the paperwork with end-to-end automation

Filing reports, keeping track of equipment used, working on the Excel sheets for multiple jobs on a daily basis, all through to the routing and billing- it can be a logistical nightmare. It’s not just about the hours spent poring through documents and typing away at calculators. Manual work exposes you to the risks of human error. Missing records, inaccurate assessments of the situation on the ground due to the overwhelming data streaming in, putting the head office staff under strain- it all hampers the productivity of the company. 

Take scheduling for instance. You have different employees, and various jobs that need their attention, at different locations. It can be a plumbing company whose clients have water filters that need to be repaired, gas boilers inspected, leaking pipes fixed, and others who need new installations to be set up. Assigning your personnel to the different situations will need to take into account the type of job, and the amount of time that it will require, aspects such as the location and the crew that is closest to it. At the head office you will want to keep tabs on the jobs that are in progress, pending, complete, those on hold, and even those that have been cancelled. Running all these through traditional manual processes is enough to drive you to the edge. What’s more, tasks that slip through your fingers amidst the confusion will result in negative feedback from your customers- which you don’t want hitting your brand.

With a field service job management software like FieldELite, you get to handle it all from one dashboard. Optimise your service delivery using the accurate scheduler, that allows you to account for the location of your employees, the status of the job- from the urgent ones like emergency tasks, to the normal duties such as routine maintenance, and low-priority tasks. The field service scheduling software comes with a real-time location feature that allows you to determine the employees closest to the client’s premises who will be appropriate for the job, map out the service areas and give you a birds-eye view of all the operations on the ground, while being updated with the progress of each specific task. Less time is spent travelling to- and from the central office, and more on actually tending to your client’s needs. You can even have situations where you can assign end-of-day tasks to employees who will be passing on that route on their way home.

  • Enhanced resource utilisation that promotes personal and professional development

Skill is key across the industries- from electrical services, solar panel installation, landscaping, home remodelling, pest control, plumbing, HVAC system maintenance, to construction and property management. For the job to be done appropriately and make your clients happy, you want to assign the task to an employee who is particularly proficient at it. This tends to be glimpsed over during manual scheduling since the personnel at the head office will be swamped with so many files, and will pick the first one that comes close to fitting the job description, leading to overlapping of roles. Sure, they may get it done, having seen their colleagues do it and even helping them out when they worked together before on similar projects- but will it be up to the required standard? On the other hand, the FSM allows you to ensure that you get the right technician for the task- who will be more motivated, boosting their performance.

What about accidents? Your employees want to feel safe as they go about their mandate. Many of the field service jobs are hazardous- such as electrical repair jobs, window cleaning tasks at high rise buildings, to elevator repair jobs where a slight glitch can lead to severe ramifications. Field service management software also comes in handy here, where the head office can be notified of any emergency the moment it occurs, and arrange for the necessary action to be taken immediately. That way, your employees will not feel neglected while they are out in the field, showing them that their safety is a priority to your business- which in turn increases their morale. 

  • Readily available knowledgebase and feedback system

When the employees have been assigned a specific job, they will require certain information about it. This includes the scope of the task, history of previous repairs or maintenance that was carried out, accompanying images if needed, risk assessment, any hazards or contaminants that they will need to prepare for, to notes left by technicians who had handled it. Having to keep checking their email, or picking up documents at the office for the day’s job and walking around with them all day as they tend to one customer after another, will slow things down, and not to mention frustrate them. However, the FSM system is directly accessible by the employees via app on their phones. The information needed for each specific task will thus be at their fingertips, speeding up the process and ensuring that they will be ready for each project being handled. 

While carrying out the job itself, the employees will use the very same app to update the system on how it is progressing, chat with the staff at the head office, update the inventory and even place orders for extra parts if necessary. Since mobile service management software apps like FieldElite also work in offline mode, the photos, reports and other entries that are made are collected by the app and saved on the device. Once a network connection is established, they are then updated to the central database- thus ensuring that the job can proceed regardless of the location. 

Once the job is completed, the customer input is also taken, registered in the system through their e-signature. A signoff comment included gives the customer the opportunity to indicate their experience with the job, and the feedback that they would like to provide. In case the job has not been completed, then the scheduling software kicks in, putting it in queue for another appointment to take care of the task, or resolve the issue that had caused it not to be completed the first time. The completed tasks head right to invoicing, which is also handled within the field service management platform, making it a seamless task for the head office staff.

Total Quality Management

Total Quality Management (TQM) is another business management approach that focuses on the involvement of all members of the organisation to participate in improving processes, products, services, and the culture in which they work in. It is important that every team member realises how each individual and each activity affects, and in turn is affected by, others.

With the use of combined quality and management tools, TQM also aims to reduce losses brought about by wasteful practices, a common concern in most companies. Using the TQM strategy, business would also be able to identify the cause of a defect, thereby preventing it from entering the final product.

Deming’s 14 Points

At the core of the Total Quality Management concept and implementation is Deming’s 14 points, a set of guidelines on quality as conceptualised by W Edwards Deming, one of the pioneers of quality. Deming’s 14 points are as follows:

  1. Create constancy of purpose for improving products and services.
  2. Adopt the new philosophy.
  3. Cease dependence on inspection to achieve quality.
  4. End the practice of awarding business on price alone; instead, minimise total cost by working with a single supplier.
  5. Improve constantly and forever every process for planning, production and service.
  6. Institute training on the job.
  7. Adopt and institute leadership.
  8. Drive out fear.
  9. Break down barriers between staff areas.
  10. Eliminate slogans, exhortations and targets for the workforce.
  11. Eliminate numerical quotas for the workforce and numerical goals for management.
  12. Remove barriers that rob people of pride of workmanship, and eliminate the annual rating or merit system.
  13. Institute a vigorous program of education and self-improvement for everyone.
  14. Put everybody in the company to work accomplishing the transformation.

But if you were to reduce to bare bones the TQM philosophy from Deming’s 14 points, it would all come down to two simple goals:

  1. To make things right the first time; and
  2. To work for continuous improvement.

As with all other quality management process, the end goal is to be able to offer products and services that meet and even exceed customer’s expectations.

Find out more about our Quality Assurance services in the following pages:

Ready to work with Denizon?

Contact Us Today