GRC Journal - (Page 18) THE 2006 GOVERNANCE, RISK MANAGEMENT & COMPLIANCE INDEX BY RICHARD WILSON, EXECUTIVE VP, RESOLVER INC. In May and June of 2006, an audience poll was conducted in the U.S. with over 450 participants to understand where and how they were progressing in their Governance, Risk Management, and Sarbanes-Oxley Compliance (GRC) efforts. The poll was chaired by the prominent PricewaterhouseCoopers’ Partner and Enterprise Risk Management National Practice Leader, Brian J. Kinman. The poll was conducted using Resolver Ballot group assessment software. PARTICIPANT PROFILES: Participating in the poll were both publicly traded and private companies ranging from 25 percent who were small cap (under $700m) to 75 percent who were large cap (over $700m) organizations. The audience breakdown consisted of SOX leaders/team members (55 percent), internal audit (15 percent), controllers (10 percent), and various other positions who accounted for the remaining 20 percent. The industries they worked in consisted of consumer and industrial products (22 percent), financial services (25 percent), telecommunications/information/communications (10 percent), entertainment and media (10 percent), and the remaining third came from various other industries. Sixtyfive percent of participant companies had reported under Sarbanes-Oxley 404. SUSTAINABILITY A KEY FOCUS: Before delving into the specific results of the poll, I would like to describe the strategic direction that companies like PricewaterhouseCoopers are advocating to companies who are managing SOX programs or are pursuing higher levels of excellence in building effective controls over financial reporting. Particularly with SOX, many companies have brought a “project” mindset to their compliance efforts (See Fig. 1). With the initial volume of documentation and testing required and deadlines looming, the approach to meet the deadline often included “Band-Aids” to get the SOX project completed. Temporary teams were assembled to complete the task, but not surprisingly in many cases, the temporary status has turned into permanent positions. Crossing the goal line for year one did not provide much satisfaction as 52 BTQ people began to see the continued requirements moving forward and the need to improve upon a hurried and laborintensive first, and even second year. Kinman defined sustainability as, “the ability of a company to routinely analyze, test, and report on the design and operating effectiveness of internal controls over financial reporting. It is not just about the compliance process but about maintaining good controls over financial reporting. The three main elements of a sustainable process are: 1) an effective accountability structure that stretches across the entire organization; 2) an effective operating structure facilitated by, in many cases, a Chief Internal Control Operating Officer; and 3) an effective technology enablement structure. A sustainability program should enhance business execution and performance, as well as ensure compliance with 404.” With this best practice model in mind, let’s examine where corporations in the U.S. currently reside with respect to GRC. THE RESULTS: Deficiencies and Band-Aids: Thankfully, for 79 percent of respondents, the total deficiencies identified in the second year of SOX were somewhat or significantly lower versus their first-year compliance efforts. Sixty percent of the companies reported that they went back after Year 1 to review their issues to check that the remediation was sustainable. For all companies, only 6 percent claimed that they had no “BandAids” in place from Year 1 and Year 2 remediation efforts because they had done it correctly from the beginning. For the remaining majority, one-third still have “Band-Aids” in place and are currently not sure where all of them reside. Key Controls and Control Automation: When asked about reducing the total number of key controls in their company, 97 percent of respondents confirmed that they were making an effort to do so. Personnel accountable for internal control compliance confirmed they were struggling to establish the appropriate level of documentation necessary to support management’s assessment of internal controls over financial reporting. For those participants who had been able to reduce their key Business Trends Quarterly Q1 2007 | www.btquarterly.com http://www.btquarterly.com
For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.