Compliance offers opportunity to strengthen business.

• Author: Marcello, Scott M.

With the enactment of the Sarbanes-Oxley Act of 2002 (SOX), executives, corporate boards and audit committees are now required to focus a significant amount of labor on monitoring the effectiveness of internal controls for financial reporting.

**********

Complying with these new regulations may seem to be a distraction from their efforts to improve profits and drive value. However, compliance offers a real opportunity to strengthen a business.

[ILLUSTRATION OMITTED]

For senior executives and their boards, improving the company's performance and creating value is the main focus behind any new initiative, whether it is an acquisition or divestiture, a joint venture, re-engineering a supply chain, or a decision to outsource.

Some leaders believe that efforts to implement the controls required by SOX Section 404 have diverted energy and resources from business improvement activities without providing compensatory value. Nevertheless, companies are now at the beginning of a long compliance journey. Going forward, organizations will need a dual focus, including:

1. Sustain an ongoing assessment process for SOX compliance.

2. Balance risk and controls while identifying and pursuing performance improvement opportunities to strengthen the business.

Ideally, efforts to comply with SOX will have helped the executive suite understand the nature of the company's controls, processes, and systems; where they are located; and by whom they are performed. This is information that, for most companies, did not exist in one place before the SOX mandate.

These insights about the business, which can be derived from detailed analyses of company controls and business processes, can lead to important business strategy changes. This knowledge provides leaders with a new means of considering and managing risk, improving the quality of their initiatives, and driving a return on the SOX investment.

Most companies are in the initial compliance phase with Section 404 (Illustrated in the lower left corner of the graph in Figure 1). This series of compliance exercises can provide organizations with a foundation for executives to build further improvements to both their controls and their business processes--ultimately integrating risk management across the organization and transforming processes.

The positive result is that information on the organization's controls portfolio--a collection of information about controls housed in one place--provides leaders with a new lens...