Information and Communication, Monitoring, and Startup Tips

The Sarbanes-Oxley Act (SOX) placed new requirements on American companies to ensure the integrity, reliability, and accuracy of financial reporting and corporate disclosures. While you could do this on your own or manually, why reinvent the audit controls wheel? Automated tool sets and repositories to facilitate SOX compliance are available in ample numbers. But like any piece of software, you have to know what to look for to meet your organization's expectations and avoid disappointments. This research note examines critical attributes of SOX tool sets, discussing how you can utilize them effectively to maximize the return on your investment of time and money.

Part One examined the first three components of the COSO Integrated Framework relative to selecting a SOX tool set.

Part Two discusses the information and communication, and monitoring components from a similar perspective and provides some tips for kicking off the tool set selection process.

What is COSO?

COSO stands for Committee of Sponsoring Organizations of the Treadway Commission. It is a voluntary private-sector organization dedicated to improving the quality of financial reporting through business ethics, effective internal controls, and corporate governance. The Securities and Exchange Commission (SEC) ruled that management must base its evaluation on a suitable, recognized control framework established by a group that has followed due-process procedures, including the broad distribution of the framework for public comment. Furthermore, the SEC points out in its final rule that the COSO Internal Control—Integrated Framework, which is depicted in the three-dimensional diagram to the right, satisfies this requirement. Accordingly, the majority of organizations have adopted this framework as the basis for compliance with Section 404 of SOX, namely Management Assessment of Internal Controls.

When evaluating SOX tool sets, doesn't it make sense to determine how well the proposed software satisfies critical components of the COSO framework? Of course it does. The remainder of this note examines the five components of the COSO framework, outlining the key characteristics and attributes you should consider in selecting a SOX tool set. Specifically, these components include:

* Control environment

* Risk assessment

* Control activities

* Information and communication

* Monitoring

A brief description and introduction, as denoted in italics, is provided of how each component will assist in achieving internal control objectives as depicted in the second dimension (top level view) of the framework. These control objectives provide for the following:

Audit Considerations for Enterprise Software Implementations

Recent scandals in the corporate world have created a refreshed awareness of the audit function. A direct by-product of these scandals is the Sarbanes-Oxley Act of 2002 (SOX), which gives legal and financial muscle to the assurance of the integrity, reliability, and accuracy of financial reporting and corporate disclosures. In fact, based on a recent survey of CFO's and IT executives, 71 percent of the respondents believe that Section 404 of the Act, which requires business process audits and documentation to support internal controls certification, is the most critical part of SOX. While some may argue that the Act does not go far enough, it is surely a positive, aggressive start.

While this reemphasis may be good news for current and ongoing systems, the process of developing an audit awareness and the need for substantial controls can and should be established as software is being implemented. If you are the project manager or the project sponsor, possibly the company's CEO or CFO, it is in your best interest to create a financially healthy environment from the start of the implementation project. The expectation is that this good inbreeding will continue with the software into production and throughout its entire lifecycle. Considering the extensive scope of enterprise software such as enterprise resource planning (ERP), supply chain management (SCM), and warehouse management systems (WMS) software, the need for adequate and substantial controls is even more apparent.

This two-part article looks at four key segments of an enterprise software implementation, with timely emphasis on SOX, and suggests audit procedures, controls, and processes that should be typified, observed, tested, and reported upon. These segments include:

* Project Planning and Management
* Documentation and Reporting
* Software Piloting
* Data Conversion

Clearly, there may be others and, hopefully, this discussion can encourage or scare you into identifying these other areas that may be pertinent and cost-effective to your organization.