By Amey Stone Section 404 of the 2002 Sarbanes-Oxley corporate-governance legislation requires companies to prepare a report assessing their internal financial controls and have their external auditor sign off on it. All large public companies with a fiscal year ending after Nov. 15, 2004, must complete the process by the end of their fiscal year, which leaves just a few months for outfits on a calendar year (see BW Online, 9/20/04, "Hardly Ready for Sarbanes-Oxley").
"It's an enormous effort, particularly for multinational companies," says Dan DiFilippo, a partner at PricewaterhouseCoopers. "There aren't a lot of shortcuts." Companies do have, however, a few ways to speed things up if they're falling behind. Here are some tips from the experts:
Marshal all your resources on Section 404. This is a problem worthy of Herculean efforts. "My advice is, if you feel like you're late, stop all nonessential activities and focus all your efforts on getting this done," says John Hagerty, an analyst with AMR Research in Boston. It's unclear what penalties or market reactions companies will face if they miss the deadline or their auditors report material weaknesses in their internal controls, but as Hagerty notes, "no one wants to be the first to figure it out."
Find some extra people to throw at the problem. If your internal audit staff is tapped out, turn to temp agencies. Dino Grigorakakis, regional vice-president for consulting services at temporary staffing firm Robert Half International, says its Management Resources and Accountemps divisions have been supplying staff for Sarbanes-Oxley-related jobs. "For the most part" he says Half has been able to fill demand, even though the supply of qualified candidates has decreased this year as the job market has improved, he says.
Many companies are putting their most experienced internal accountants on Sarbanes-Oxley matters and hiring temps to take up the more routine tasks, says Grigorakakis. Another option: Turn to a local university where some accounting students may be happy to help out with some of grunt work involved.
Look for ways technology can assist. For companies that operate on a calendar year, it's really too late to try to implement software to help with Section 404 this year, says Hagerty. But if your fiscal year doesn't end until next March or June, software packages may yet be able to help you automate some of the processes involved, he says.
Tim Welu, CEO of Paisley Consulting, says compliance software, like his firm's Risk Navigator product, can help out, especially when it comes to organizing data into a coherent report. If you're still battling with reams of spreadsheets, that's not a bad idea.
Video Q&A: Compliance Rush
Paisley Consulting CEO Tim Welu on why many companies will be late meeting the new Sarbanes-Oxley rules
However, Barry Lurie, a partner with the Global Infrastructure Services business at info-tech consulting firm Unisys (UIS) warns companies not to rush into new software this year or risk "throwing good money after bad." Many big IT outfits are pitching clients new services that can help next year.
Keep everyone in the loop. If you're running behind or turning up more problems than expected, your auditors, board members, and, yes, even your shareholders, need to know about it. By understanding where you are in the process, perhaps your auditor can start testing some of your control processes while you continue to work on others, says Lynn Edelson, a partner at PricewaterhouseCoopers. "Companies really need to be in lock step with the auditors," she says. Likewise, the audit committee of the board of directors should be informed if the timetable is slipping.
"The worst thing for anybody to have is a surprise," says Edelson. If the compliance process isn't going well, companies may want to disclose that in a quarterly filing to keep investors from getting surprised. According to newsletter Compliance Week, many businesses are already taking this step.
Pull the report together as best you can. Even if your auditor doesn't give you a clean bill of health in its final assessment, that would be better than missing the SEC deadline for filing, says Anthony Miller, an executive vice-president at LRN, a compliance and ethics training firm. Gather some documentation, do a self-assessment, and show some plans for improvements, he suggests. "Go through the whole process, even if it's not very deep," he says. "If you can't be completely in compliance, at least have a plan to fix it."
Such an approach would probably result in auditors reporting weaknesses in your company's internal controls. No one can tell how the market will react to that kind of news, but it will surely be less harsh than for companies that report their internal controls are perfect, only to have their auditors find holes. When it comes to complying with Section 404, doing as good a job as possible -- even if not a perfect one -- may be the best many companies can hope for this year. Stone is a senior writer at BusinessWeek Online in New York