How to Reduce Costs when Complying with SOX 404

Section 404 contains the most onerous and most costly requirements you’ll ever encounter in the Sarbanes-Oxley Act (SOX). In this article, we?ll take a closer look at the salient points of this contentious piece of legislation as it relates to IT. We?ll also explain why companies are encountering difficulties in complying with it.

Then as soon as we’ve tackled the main issues of this section and identify the pitfalls of compliance, we can then proceed with a discussion of what successful CIOs have done to eliminate those difficulties and consequently bring down their organisation’s IT compliance costs. From this post, you can glean insights that can help you plan a cost-effective way of achieving IT compliance with SOX.

SOX 404 in a nutshell

Section 404 of the Sarbanes-Oxley Act, entitled Management Assessment of Internal Controls, requires public companies covered by the Act to submit an annual report featuring an assessment of their company?s internal controls.

This ?internal control report? should state management’s responsibility in establishing/maintaining an adequate structure and a set of procedures for internal control over your company?s financial reporting processes. It should also contain an assessment of the effectiveness of those controls as of the end of your most recent fiscal year.

Because SOX also requires the public accounting firm that conducts your audit reports to attest to and report on your assessments, you can’t just make baseless claims regarding the effectiveness of your internal controls. As a matter of fact, you are mandated by both SEC and PCAOB to follow widely accepted control frameworks like COSO and COBIT. This framework will serve as a uniform guide for the internal controls you set up, the assessments you arrive at, and the attestation your external auditor reports on.

Why compliance of Section 404 is costly

Regardless which of the widely acceptable control frameworks you end up using, you will always be asked to document and test your controls. These activities can consume a considerable amount of man-hours and bring about additional expenses. Even the mere act of studying the control framework and figuring out how to align your current practices with it can be very tricky and can consume precious time; time that can be used for more productive endeavours.

Of course, there are exceptions. An organisation with highly centralised operations can experience relative ease and low costs while implementing SOX 404. But if your organisation follows a largely decentralised operation model, e.g. if you still make extensive use of spreadsheets in all your offices, then you’ll surely encounter many obstacles.

According to one survey conducted by FEI (Financial Executives International), an organisation that carried out a series of SOX-compliance-related surveys since the first year of SOX adoption, respondents with centralised operations enjoyed lower costs of compliance compared to those with decentralised operations. For example, in 2007, those with decentralised operations spent 30.1 % more for compliance than those with centralised operations.

The main reason for this disparity lies in the disorganised and complicated nature of spreadsheet systems.

Read why spreadsheets post a burden when complying with SOX and other regulations.

Unfortunately, a large number of companies still rely heavily on spreadsheets. Even those with expensive BI (Business Intelligence) systems still use spreadsheets as an ad-hoc tool for data processing and reporting.

Because compliance with Section 404 involves a significant amount of fixed costs, smaller companies tend to feel the impact more. This has been highlighted in the ?Final Report of the Advisory Committee on Smaller Public Companies? published on April 23, 2006. In that report, which can be downloaded from the official website of the US Securities and Exchange Commission, it was shown that:

Companies with over $5 Billion revenues spent only about 0.06% of revenues on Section 404 implementation
Companies with revenues between $1B – $4.9B spent about 0.16%
Companies with revenues between $500M – $999M spent about 0.27%
Companies with revenues between $100M – $499M spent about 0.53%
Companies with revenues less than $100M spent a whopping 2.55% on Section 404

Therefore, not only can you discern a relationship between the size of a company and the amount that the company ends up spending for SOX 404 relative to its revenues, but you can also clearly see that the unfavourable impact of Section 404 spending is considerably more pronounced in the smallest companies. Hence, the smaller the company is, the more crucial it is for that company to find ways that can bring down the costs of Section 404 implementation.

How to alleviate costs of section 404

If you recall the FEI survey mentioned earlier, it was shown that organisations with decentralised operations usually ended up spending more for SOX 404 implementation than those that had a more centralized model. Then in the ?Final Report of the Advisory Committee on Smaller Public Companies?, it was also shown that public companies with the smallest revenues suffered a similar fate.

Can we draw a line connecting those two? Does it simply mean that large spending on SOX affects two sets of companies, i.e., those that have decentralised operations and those that are small? Or can there be an even deeper implication? Might it not be possible that these two sets are actually one and the same?

From our experience, small companies are less inclined to spend on server based solutions compared to the big ones. As a result, it is within this group of small companies where you can find a proliferation of spreadsheet systems. In other words, small companies are more likely to follow a decentralised model. Spreadsheets were not designed to implement strict control features, so if you want to apply a control framework on a spreadsheet-based system, it won’t be easy.

For example, how are you going to conduct testing on every single spreadsheet cell that plays a role in financial reporting when the spreadsheets involved in the financial reporting process are distributed across different workstations in different offices in an organisation with a countrywide operation?

It’s really not a trivial problem.

Based on the FEI survey however, the big companies have already found a solution – employing a server-based system.

Typical server based systems, which of course espouse a centralised model, already come with built-in controls. If you need to modify or add more controls, then you can do so with relative ease because practically everything you need to do can be carried out in just one place.

For instance, if you need to implement high availability or perform backups, you can easily apply redundancy in a cost-effective way – e.g. through virtualisation – if you already have a server-based system. Aside from cost-savings in SOX 404 implementation, server-based systems also offer a host of other benefits. Click that link to learn more.

Not sure how to get started on a cost-effective IT compliance initiative for SOX? You might want to read our post How To Get Started With Your IT Compliance Efforts for SOX.?

Check our similar posts

Field service and its impact on your bottom line

There are many pointers to successful field service in any business. Generally, labour hours, parts, technician efficiency, performance indicators and other bunch of data are the most important. However, the icing on top is the total revenue. If you are in business, you must be cocksure that it’s making money, and when you don’t rake in enough you need to make some business decisions quick!

For the most part, field service companies will always have a field service management software to handle all the data. But how will this affect your outlook?

Will this cause a direct increase in revenue?

What will still need to be changed so that the ship stays afloat?

Increase your service jobs

As expected, the best field management software will guarantee a positive increase in appointments per week. On average, the field service team should expect at least a 50% increase in work turnover. There is a direct relation between the revenue you should be making and the number of calls in your schedule since the only way of making more cash is to get more work done. It is not recommended to raise costs because it increases the risk of losing customers easy when they can’t meet the extra expense. Field service software will help you bring in more customers and also manage technicians.

If you have much of the hard work done for you then you?d have more time to run the show. This is why premises are trying out software because they answer many problems like:

Automation and improved work order management
Fast dispatch from an array of drag-drop scheduling tools
Easy-to-use field service apps for technicians to receive and submit work orders
Can be integrated into account systems for faster billing time

Manual operations are costly and prone to error, and they don’t come cheap. Do away with them, reduce costs, sit back and watch as new customers steadily stream in. Grow the business by building lasting relations with your workforce and customers.

Increase technician?s abilities with mobile

If you want to get more profit, bank on technicians who complete service calls. Their task is obviously the hardest. They have an unpredictable job; at times they need to come up with quick responses or they may also be required to dig deep as well. The work does not need to be slowed with an endless paper trail while they could be elsewhere giving their all. These technicians require a working mobile field service management app.

As expected, field service leaders who use a mobile field service software report close to 20% increase in service visits per technician. This translates to each technician taking nearly a fifth more calls in a day. And as we had said before, more service calls can double the profits. How can technicians get extra time from a field service mobile app?

No need to drive to work to pick orders
Less time using the phone looking for service or parts information
Reduces the time needed to go through paper-based work
Less time driving to service calls because information is routed to their mobile phones

Increase revenue from technicians

If time is spent seamlessly, dispatchers will find time in a technician?s schedule for an extra service call. With all this being done within normal working hours, the business stands to increase its bottom line. This is what makes the business grow. Not by increasing technicians but by optimum utilisation of the current staff to get maximum profit. The logic is straightforward ? a technician working 8 hours each day taking six calls a day will make more revenue than the one who takes four, because they are paid the same each, but the business benefits from the extra service calls.

The business stands to make more revenue per technician if it uses field service management software. The margins can go as high as 40% because the technician has all tools needed to get the job done faster. You increase revenue from field work too. Let technicians benefit from automated process and have all the tools for work that they need right on their mobile devices.

The target is always your bottom line

When field service leaders inquire about field service software, they need to know how it affect the bottom line: how they will spend less time drafting schedules, how each technician will increase revenue, how the business will grow. Simple as that!
Field service management applications bring a lot to the table.

Don’t waste your time crunching a lot of numbers or sorting out schedules since this is what such an application should do. Automation, optimisation and mobility are all ways of increasing revenue. Let us help you reach your goals using our top shelf field management software. This will not only help your bottom line but will let you have more time to venture into untapped potentials.

UK Government Updates ESOS Guidelines

Britain?s Environment Agency has produced an update to the ESOS guidelines previously published by the Department of Energy and Climate Change. Fortunately for businesses much of it has remained the same. Hence it is only necessary to highlight the changes here.

Participants in joint ventures without a clear majority must assess themselves individually against criteria for participation, and run their own ESOS programs if they comply.
If a party supplying energy to assets held in trust qualifies for ESOS then these assets must be included in its program.
Total energy consumption applies only to assets held on both the 31 December 2014 and 5 December 2015 peg points. This is relevant to the construction industry where sites may exchange hands between the two dates. The definition of ?held? includes borrowed, leased, rented and used.
Energy consumption while travelling by plane or ship is only relevant if either (or both) start and end-points are in the UK. Foreign travel may be voluntarily included at company discretion. The guidelines are silent regarding double counting when travelling to fellow EU states.
The choice of sites to sample is at the discretion of the company and lead assessor. The findings of these audits must be applied across the board, and ?robust explanations? provided in the evidence pack for selection of specific sites. This is a departure from traditional emphasis on random.

The Environment Agency has provided the following checklist of what to keep in the evidence pack

Contact details of participating and responsible undertakings
Details of directors or equivalents who reviewed the assessment
Written confirmation of this by these persons
Contact details of lead assessor and the register they appear on
Written confirmation by the assessor they signed the ESOS off
Calculation of total energy consumption
List of identified areas of significant consumption
Details of audits and methodologies used
Details of energy saving opportunities identified
Details of methods used to address these opportunities / certificates
Contracts covering aggregation or release of group members
If less than twelve months of data used why this was so
Justification for using this lesser time frame
Reasons for including unverifiable data in assessments
Methodology used for arriving at estimates applied
If applicable, why the lead assessor overlooked a consumption profile

Check out: Ecovaro ? energy data analytics specialist

What ISO 14001 Status did for Cummins Inc.

Cummins manufactures engines and power generation products, and has been a household name almost since inception in 1919. It sells its products in over 300 countries, through approximately 6,000 dealerships employing 40,000 people. Because its product line runs off fossil fuel it is under steady pressure to display a cleaner carbon footprint.

Cummins decided to go for the big one by qualifying for ISO 14001 certification. This is a subset of a family of standards relating to managing environmental impact while complying with all applicable legislation. In this sense, it is similar to the ISO 9000 quality management system, because it focuses on how products are produced (as opposed to how those products perform). Compliance with ISO 14001 was a doubly important goal, because it is part of the European Union?s Eco Management and Audit Scheme and fast becoming mandatory on suppliers to governments.

The qualification process follows the well-established principle of plan, do, check, act. It begins with gap analysis to detect materials and processes that affect the environment. This is followed by implementation of necessary changes affecting operations, documentation, emergency strategies and employee education. The third step involves measuring and monitoring performance. Finally, the project moves into a phase of ongoing maintenance, and continuous improvement as circumstances change.

In Cummins case, the project was almost worldwide and called for environmental, health and safety reporting throughout the organisation. The information was shared via a globally accessible document repository, and then processed centrally at the head office in Columbia, Indiana USA.

Measuring environmental performance almost inevitably has other benefits that make it doubly worthwhile. Speaking at the 2014 National Safety Council Congress after receiving the top award for excellence, Cummins chairman and ceo Tom Linebarger commented on a journey that was ?nothing short of amazing? yet wasn’t even a ?pathway to the finish line?.

?All of us feel like we have way more to do to make sure that our environment is as safe as it could be,? he added, ?so that our sustainability footprint is as good as it can be and that we continue to set more aggressive goals every year. That’s just how we think about it.? Linebarger concluded.

If you are taking your company on a journey to new heights of environmental excellence, then you should consider choosing ecoVaro as your travelling companion. We are environmental management specialists and have proprietary software geared to process your data. We also have a wealth of experience, and a treasure chest of roadmaps to help you achieve your goal.