Maintaining Control

Corporate governance has become increasingly critical over the years, with organizations being assigned a growing responsibility to ensure that they meet all legal requirements. The primary source of compliance requirements for American companies is the Sarbanes-Oxley Act (SOX), which was enacted in 2002 to protect investors and maintain the integrity of the financial reporting system.

SOX has become an essential piece of legislation for public companies with significant financial reporting processes. The act requires companies to establish and maintain internal controls and places executives responsible for ensuring that these controls are effective. While potentially daunting, the Act’s compliance requirements can be managed effectively and efficiently with SOX best practices.

Sarbanes-Oxley Act Best Practices

Best practices for companies complying with SOX include taking a structured approach to their compliance efforts. This can involve thoroughly assessing the current state of their SOX program, identifying areas where automation can be applied, and prioritizing these areas based on the potential impact on compliance effectiveness and efficiency.

During an assessment, it is also important to engage process stakeholders throughout the organization, including IT, finance, legal and operations teams, ensuring that all parts of the SOX program are addressed.

Even with a structured approach, SOX compliance has been challenging for many companies. Internal audit teams have struggled to find efficient ways to comply with the law’s requirements while also managing compliance costs.

Conducting a retrospective with key stakeholders can help identify trends and insights that can improve a company’s overall SOX program. In addition to a retrospective, it is also important to update risk assessment factors and digitize SOX documentation to make updates easier and ensure that all stakeholders have access to accurate and up-to-date information.

Many companies have found technology and automation to be the key to achieving greater efficiency, especially in documentation and testing. Protiviti’s 2021 Sarbanes-Oxley Compliance Survey found that companies who invested in digital transformation increased compliance effectiveness while reducing compliance costs. The results emphasize the importance of digitizing data, upgrading underlying technological infrastructure and shifting to cloud-based solutions.

Of the many requirements of SOX, one requires the special attention of executives. Section 302 of SOX outlines the requirements for executive certification of financial reports. The section requires that the CEO and CFO certify the accuracy of the financial statements and that they have disclosed any significant deficiencies in the internal control system or any fraud involving management or other employees. This certification must be included in the company’s annual report.

A Tool for SOX Section 302

There are a variety of SOX tools available to help maintain compliance. For Section 302, one such tool is the Sarbanes-Oxley Section 302: Executive Certification Questionnaire (ECQ), a comprehensive compliance tool that helps organizations follow certification requirements. The tool helps executives ensure that their companies have a functioning system in place that lets them certify financial reports accurately.

The ECQ has a comprehensive list of questions covering all parts of a company’s financial reporting system, including internal controls, financial reporting and disclosures. Some sample questions include:

• Have you discussed the company’s disclosure controls and procedures with management?
• Has management taken a process view to address these requirements?
• Are you satisfied that the disclosure controls and procedures are designed effectively?
• Based on your discussions with management, are you satisfied that the company’s disclosure controls and procedures are operating effectively?
• Based on your knowledge of the company and the information received from management, would you sign the certification?

The questionnaire is designed to be completed annually, and it provides a detailed record of the steps taken by executives to ensure that the financial statements are accurate and complete. The tool makes sure executives take personal responsibility for the accuracy of company financial statements. It also helps organizations identify any significant deficiencies in their internal control system or any fraud involving management or other employees.

By completing the ECQ, executives can demonstrate to investors and stakeholders that they take their responsibility for the accuracy of financial statements seriously. The tool helps organizations maintain compliance with SOX, which can help to avoid potential legal and financial penalties.

The ECQ is also an excellent tool for organizations seeking to improve their internal control systems. By identifying deficiencies and areas for improvement, organizations can use the ECQ to take proactive steps and enhance their internal control systems and reduce the risk of fraud or error. This can help increase investor confidence and improve the organization's overall financial health.

To get the most benefit from the questionnaire, companies should ensure that their executives take the time to complete the questionnaire thoroughly and that they review their responses carefully. By doing so, executives can make sure they have a comprehensive understanding of their company’s financial reporting practices and can identify any areas that may need improvement.

The ECQ is an essential tool for companies that need to comply with SOX, and one worth including in a best practices collection of Sarbanes-Oxley Act templates and procedures. By using this tool, executives can ensure that they are fulfilling their responsibilities to certify the accuracy of financial statements and that they are doing so based on a comprehensive understanding of their company’s financial reporting practices.

Wrapping Up

Protiviti’s survey shows that many teams still face obstacles in achieving the change they seek, including the level of effort required to implement, govern and maintain the automation of the SOX compliance process. Nevertheless, the importance of company processes married with Sarbanes-Oxley Act integration cannot be dismissed.

SOX controls are critical for ensuring the accuracy and integrity of financial reporting for public companies. While compliance efforts can be time-consuming and resource-intensive, organizations that leverage technology and automation in their SOX compliance programs can achieve greater efficiencies and potential cost savings while also improving the effectiveness and coverage of their controls.

While difficult, companies that integrate their systems by making prudent investments will be in a better position than their peers who neglect this aspect of corporate strategy. Investments in cloud-based SOX and audit management software have been instrumental in enabling organizations to maintain the administrative and project management aspects of the overall SOX program.

Even implementing a single tool, the Executive Certification Questionnaire, can be a significant undertaking. It requires the commitment and cooperation of executives and other key stakeholders. However, the benefits of using this compliance tool as part of your SOX compliance system are worthwhile. By using the ECQ, organizations can show their commitment to good corporate governance, increase SOX integration, maintain compliance and improve overall financial health.

When companies take a structured approach to their SOX compliance efforts and engage stakeholders throughout the organization, they can ensure that they are well-positioned to meet their compliance obligations and protect the interests of their shareholders and other stakeholders.