Designing a Section 404 project: Financial Executives Research Foundation looks at the technology used and future implementation expectations for Section 404 projects.

• Author: McCann, Tiffany
• Position: Compliance - Management Assessment of Internal Controls

When the Sarbanes-Oxley Act of 2002 was signed into law, it was obvious compliance would require significant effort from financial executives. An area of particular concern was Section 404, Management Assessment of Internal Controls.

With an original requirement for implementation during the 2003 reporting year and vague guidance from the Securities and Exchange Commission (SEC), implementation was a challenge, and executives began developing action plans. They expressed confidence that their company's internal controls were adequate. However, the CEO and CFO, who would now be required to attest to the adequacy of the controls, had no visibility into their controls systems, and had no quantitative assurance about the extent of controls testing.

Financial Executives Research Foundation (FERF) queried executives to determine how Section 404 projects are organized and executed and what technology is being used to gather the mass of internal control documentation needed to ascertain compliance. It also identified implementation challenges and expectations for future compliance.

"The first year of compliance will be the most costly, as companies use consultants and new technology to document and evaluate processes. But, they are positioning themselves to go forward on a self-sustaining basis with the workforce currently in place. We don't see companies hiring new employees dedicated to Section 404 compliance," says James DeLoach, managing director at Protiviti Inc., in thoughts echoed by others.

The key personnel requirement is a project manager with a background in finance, to manage and direct multiple departments and timelines. Whether from internal audit, accounting, treasury or another finance area, the project manager's expertise is valuable. Greg Jamieson, project manager for Section 404 at The Coca-Cola Co., cites his internal audit, corporate and international finance experience as advantageous.

"I have a good understanding of how financial information flows throughout our organization. This knowledge has been a great asset to me as we implement Section 404," says Jamieson.

The Solutions

Steve Miranda, vice president of financial applications for Oracle Corp., says, "Good corporate governance requires an integrated set of systems focusing on control, visibility and efficiency." Tactically, for most, the Section 404 solution serves as a central repository for internal control documentation; it also facilitates the testing of controls by...