Technology: Sarbanes-Oxley - ' Avoid Garbage '
(
Page 4 of 5 )
Step 3: Avoid Garbage
What's the role of technology? Make sure the quality of the data going into reports means there's nothing inaccurate coming out.
The sleuthing game for IT involves figuring out where systems issues, such as the processes baked into customer relationship management and sales force automation, affect financial reporting. You must be able to document how the chain of financial reporting works and how your information systems support it. And you must have a clear idea of where that chain can break down, and be prepared to survive an audit of those processes in case something does break.The trick is knowing just how IT systems grease the flow of any potentially erroneous or inconsistent information—or even help create it.
Suppose a hypothetical widget manufacturer has a relatively loose process for recording orders and payments. While no fraud may be intended whatsoever, salespeople are allowed to book orders lacking absolute certainty that a sale will be completed.
Or suppose a software company allows revenues to be recognized
before an application was signed off as a released product. The result under
Sarbanes-Oxley: Your company may be overstating revenue in one quarter that
requires restatement the next. That was bad enough in the pre-Enron world,
but it's tantamount to Russian roulette today.
 |
| Decision Tree |
The SEC also has some strong ideas about the records you have to keep, and
how long you must keep them. A potential problem in a report today may mean
a long audit chain going back numerous quarters. There are many possible pieces
of information that federal auditors will want to review, including relevant
e-mail messages, such as communications between the CFO and the sales organization
about actual bookings. Osterman Research Inc. points to the $8 million in
fines that five Wall Street brokerage houses paid in December 2002—in
part because they didn't maintain e-mail archives for SEC- mandated periods.
The advice of some companies: Keep everything, because you still don't quite
know what will be considered germane.
There's also the speed with which the SEC wants to be notified if "germane"
events occur that could affect financial reports. For some issues, 15 business
days are allowed to lapse before notification must be provided. For others,
it's rumored that the SEC may get anxious after only two days.
Ask Your CFFO:
Exactly what information do we have to report, and how quickly must we
report it?
Ask Your IT Staff:
What are our current standards for how long we maintain different kinds
of data?
Ask Your Outsourcers:
Could our batch systems affect our ability to get timely information our
CFO might need?
test
Enterprise Technology 
