Director's guide: SOX compliance update; After three years, Sarbanes-Oxley compliance remains high on every board's agenda--but not as high as before.

• Author: Chase, Scott

Improving Sarbanes-Oxley annual assessments

TODD BRENTS Managing Director, AlixPartners

AS THE Sarbanes-Oxley Section 404 certification season is winding down for many companies, it is a good time to reflect upon the lessons learned and consider the best approach to these annual assessments. Within most organizations, the question is raised, "How can we do this more efficiently and less expensively next year?" Throughout our work at several large multinational clients, several themes emerge that are useful to consider in answering this question.

1. Develop in-house capabilities to manage annual assessment and use outside consultants for development of critical areas or processes. In developing initial SOX methodologies, most companies relied on outside consultants to define and lead the process. Although it achieves the objective, this is not an optimal long-term solution. In order to transform the process, it is important to develop resources within the organization. This transformation can be achieved by defining roles in which an outside consultant is most effective, such as defining new processes or developing project management plans, while embedding the auditing and control skills and discipline internally within the organization.

2. Put in place an effective project management plan. Because the assessment encompasses all levels of management and most locations and functional areas, it is critical to create a project management plan that factors in the challenges of organizational structures. The plan must be scheduled well in advance, allowing time to define or update process flows, develop and perform testing, perform remediation where necessary, and perform final documentation and reach conclusions. The SOX team can establish this plan well enough, but it requires functional-level management and resources to facilitate the individual process reviews. Given the challenges these areas face in their daily operations, adequate time must be allowed for the plan to filter down to the actionable levels.

3. Consolidate project management tools into a unified database and tracking tool. The final area that is important to focus on is the development of a unified database and tracking tool to store the documentation and testing results and to monitor and coordinate progress. Such a system can be purchased from third parties or developed internally, but should achieve several objectives. First, it must synchronize control documentation into a consistent format. It must also be linked to the financial reporting elements at the control level. Developing such systems can be a challenging task in multinational, multi-business enterprises, with different financial reporting formats and business processes. Second, it must be flexible enough to accommodate changes and updates to controls. Change management is an often-overlooked element. Finally, the system should be accessible to worldwide users, provide progress-tracking reports, and facilitate the hand-off of tasks between documentation, testing, remediation, and final review.

Todd Brents is a senior member of AlixPartners' Case Management Services practice (www.alixpartners.com). He has worked with Mirant Corp., Exide Technologies, Sunterra Corp., and Safety-Kleen, assisting in various aspects of their restructurings. He also served as the CFO and controller of Genuity Inc. during its bankruptcy proceedings. Prior to joining AlixPartners, Brents was at Frito-Lay Inc., where he held several positions in treasury, operations analysis, and credit.

Internal controls at year three: Where do we go from here?

CLAUDIA H. ALLEN Partner, Neal, Gerber & Eisenberg LLP

FOR MUCH OF CORPORATE America, Section 404 of the Sarbanes-Oxley Act represents well-intentioned regulation run amok. As implemented by the SEC and the PCAOB, Section 404, which requires management to assess the adequacy of internal controls over financial reporting...