ConTrak SOX - Whitepaper

Introduction

INTRODUCTION ON CONTRAX SOX

The wave of corporate scandals that followed the implosion of Enron and MCI in 2001 ushered in a deluge of corporate governance requirements that have fundamentally changed the US accounting landscape. The Sarbanes-Oxley Act of 2002 (Sarbanes-Oxley) constitutes broad legislation that addresses the corporate governance problems that emerged during the late 1990s. For many public companies, compliance with Sarbanes-Oxley is mandatory - but understanding the extensive requirements of Sarbanes-Oxley can be an intimidating endeavor. Essential to monitoring an internal control framework is the use of technology to automate the business environment to facilitate transparency and auditability. ConTrak SOX (www.contrak.net), from Object Module Inc. (OMI), enables the automation of compliance processes to facilitate rapid implementation, reduced cost of maintaining internal controls, and increased diligence in the companyâ€™s compliance regime.

Compliance with Sarbanes-Oxley is neither cheap nor easy. While the requirements defined in Sections 302 and 404 are brief, their respective impacts on the business community are substantial. Companies with extensive, complex, diverse operations need to invest heavily in compliance. Rapidly changing companies also suffer, in that their controls need to be updated almost constantly. The average cost of Sarbanes-Oxley compliance is $4.36 million, according to the Washington Post. [1] The large price tag results from high auditor expectations, minimal PCAOB guidance, and the drastic operational and organizational changes that compliance initiatives often entail.

Section 404 requires that management certify the results of an internal control audit and include the findings in its annual report. Executives are accepting more risk than they have in the past and as a result they are now personally responsible for the controls reporting and disclosures that their respective companies make. The enhanced control requirements in Sarbanes-Oxley Section 404 (Section 404) mandate a structure for preserving the integrity and reliability of reported financial data. Internal controls must be designed and implemented in a manner that makes them difficult to circumvent. A control framework will never reduce risk of financial misstatement or fraud completely. However, through the use of automated tools such as ConTrak, a company can implement a more reliable foundation for controls certification and disclosure, as well as the resulting compliance with Section 404.

Related to the requirement for the increased diligence inherent in Section 404 is a requirement that company executives:

Review financial reports
Ensure that financial reports do not contain any information that is misleading or untrue,
Assess internal controls, including remediating any deficiencies,
Determine and note material changes to the company internal control framework

ConTrak SOX provides a consistent and reliable platform for automating Sarbanes-Oxley compliance. ConTrak SOX simplifies compliance efforts and reduces the total cost of compliance by enabling businesses to automate workflows and document Sarbanes efforts. Further, ConTrak SOX offers compliance functionality that enables the auditability and management of business processes specifically related to Section 404 and 302 compliance.

Consistency is fundamental in any Sarbanes-Oxley compliance program. Remaining consistent in controls across the company helps companies develop a control framework that yields predictable and meaningful results that are difficult to bypass. The COSO framework represents a standard in Sarbanes-Oxley controls development and implementation. The COSO framework is used to determine the control and scope, offering a consistent approach to design, development, and implementation. The COSO framework consists of five components:

Control Environment
Risk Assessment
Control Activities
Information and Communication
Monitoring

Using these five elements, a company can design a control structure that reduces the amount of risk and promotes an internal control environment that ensures the Companyâ€™s financial statements are properly presented. COSO is an approach; it is not a solution in itself. COSO is the preferred methodology to use in determining the requirements of a companyâ€™s internal control framework.By relying on a software-based compliance solution, a public company can configure the solution to meet its specific needs while not eroding the integrity of the control environment.

ConTrak SOX eases the compliance burden by:

Being scalable to unique company needs
Enabling workflow management to increase oversight and define controls making them difficult for employees to circumvent
Providing visibility into the control environment and its constituent control activities
roviding individual accountability and Role-Based Access Control that is appropriate to their responsibilities
Enabling rapid, consistent, and reliable reporting and auditability

The ConTrak SOX Compliance Solution and why a company needs it

Object Module, Inc has developed a robust, fully functional SOX Compliance and Document Management application to assist companies in taking control of the requirements for SOX compliance and completing the requirements with a minimum amount of hassle at a reasonable cost.

In the wake of the SOX Compliance requirements, many companies have scrambled around searching for a way to store, maintain, and control their list of risks, controls, objectives and assertions.

Some companies have developed extensive spreadsheets to meet the requirements. Others have developed their own in-house custom applications for this purpose. All in all, each company uses a different way to store and maintain their requirements for SOX compliance and consistency, security and ease-of-use have been thrown out the window.

The ConTrak SOX Compliance application will alleviate the headaches of managing and maintaining multiple spreadsheets for tracking all of the necessary compliance information. It will also alleviate any fears associated with developing an in-house solution that might not capture all of the necessary information or appropriately present that information for auditors to review.

One of the largest impacts to companies from complying with SOX requirements has been in the form of dollars. When it is time for a SOX audit, companies must ramp up their internal temporary staffing as well as hire an external audit firm to assist in the onerous task of meeting all the requirements. The costs for the additional staff and the external consulting firm can add up rapidly and many of your smaller public companies can barely afford this.

Taking advantage of the ConTrak SOX Compliance application will not only help you organize and streamline the process of gathering all the necessary information, it will save you money. Once you go through the relatively simple set-up procedures and validate that you are capturing all of the necessary information, the audit becomes a fairly seamless and automated process.

Scalability

One of the things most evident about Sarbanes Oxley is that there is no one standard approach for all companies. What one company does may not fit for another company and the size of the SOX project may also differ greatly. ConTrak SOX is scalable to fit a variety of situations and is robust enough to handle large as well as small scale applications.

One of the most important trends in the software industry is toward software on demand. Software on demand is subscription-based technology offered as a service as opposed to the shrink-wrapped solutions that companies implement and purchase on their own. Software on demand allows companies to purchase and use only what they need, instead of spending excessive resources when they only plan to use a portion of the licenses or functionality. The use of software on demand helps keep the cost of compliance down, and the vendor provides an affordable compliance framework through economies of scale.

The advantages of software on demand reach further than ease of deployment and operational efficiency. With on-demand software, compliance through technology becomes profoundly easier to manage. Based on the ASP/MSP business model, software providers now offer software as a service, reducing the costly maintenance and resource challenges involved with maintaining a solution in house. Software can be accessed by employees as needed. The vendor owns the complexity of managing the environment, applying upgrades, and handling support.

ConTrak SOX helps public companies transfer the cost of compliance through an on-demand software platform focused singularly on efficient, effective Sarbanes-Oxley compliance. Through the on-demand model, ConTrak SOX enables companies to subscribe only to the software and functionality they need. Furthermore, companies can scale their use of ConTrak SOX easily, since OMI manages the IT infrastructure environment for them. To expand their use of ConTrak SOX, subscribing companies have to do nothing more than pick up the phone.

While the software on demand model can be particularly effective in rapidly implementing controls, some companies prefer to keep all mission-critical control systems in house. While a generic control solution can be particularly effective for companies that do not want to invest extensive resources in compliance, companies that perceive their control frameworks as mission-critical or as a competitive advantage will want to keep compliance solutions in-house.

ConTrak SOX is available as both an on-demand solution and as a local installation for clients that want to manage the application themselves. Consequently, ConTrak SOX can represent a rapidly implemented compliance solution provided as an online, on demand software application, or it can be implemented in a companyâ€™s own hosting environment. This flexible approach to implementation enables companies to expand or constrict their control investments based on specific company or auditor control requirements.

Workflow Management

Visibility

In order to comply with Sarbanes-Oxley, controls must be implemented across the company (broadly) and into the core operations of the business (deeply). ConTrak SOX provides the scalable functionality in a rapidly implementable platform.

ConTrak SOX provides an enterprise-wide view of a companyâ€™s overall control environment, as well as the individual components that comprise the control environment. ConTrak SOX compliance management functionality provides tools for monitoring the effectiveness of controls, tracking the controls inventory, and updating controls to ensure their continued relevance.

Control objectives, accounts, and risk mitigation strategies are managed in ConTrak SOX at the corporate level. Allowing a companyâ€™s central compliance resources to create control types, group specific controls by business unit or subsidiary, and assign them to the appropriate subordinate organizations in the company.

Fundamental to effective Sarbanes-Oxley compliance is the effective management of the broader compliance initiatives companies have in place. For example, every A/R control that a company has, rolls up to the effectiveness and completeness of the overall A/R control environment. Likewise, all control initiatives that a company pursues ultimately roll up to quarterly and annual reporting efforts. To account for the aggregation of control tasks into broader initiatives, Control Tasks are processes and sub-processes ConTrak SOX facilitates the grouping of specific control tasks (processes and sub-processes) into Compliance "initiatives". The use of initiatives allows a compliance owner to track company progress toward specific control objectives. The sign-off feature ensures that all components of an Initiative are complete before the Initiative itself is signed off.

The management of controls may roll up to the corporate leadership level, but responsibilities for compliance and controls management reach lower into the organization. Typically, subsidiaries are responsible for implementing their own compliance measures, as long as they adhere to corporate control standards. With ConTrak SOX, this dynamic is supported and streamlined.

ConTrak SOX offers functionality that is targeted at business units and subsidiaries. Components of a larger organization often have specific control needs that are much more granular than those of the overarching business. ConTrak SOX meets these business unit and subsidiary requirements through specific functionality that dovetails with the broader compliance management features described above.

Subsidiaries and business units tend to have their own business processes. The logical division of a larger corporation into specific business units or subsidiary business typically entails a difference of purpose or strategy for each of these constituent units. As a result, these business areas have different control needs. To comply with Sarbanes-Oxley effectively, these subordinate units need to control their own business processes. Generic corporate templates are ineffective in that they may not reflect each business unitâ€™s actual approach to the market, but any business unitâ€™s account-specific controls must be consistent with enterprise-wide control objectives and company control methodologies.

Individual Accountability

Reporting and Auditability

Document Control and Approval

Document management has emerged as one of the most vital elements of any Sarbanes-Oxley compliance program. Control over documents determines the ability to which due diligence is possible, and it facilitates the management controls and control testing, assignment of ownership and accountability through the preservation of original documents and tracking of document changes and versions.

Documentation constitutes the core of Sarbanes-Oxley compliance activities. Internal controls must be documented, used by employees for business process reference, and reviewed by auditors to ascertain compliance. ConTrak SOX enables the management of the many documents needed for Sarbanes-Oxley, including:

Control Objectives
Account References
Control and Process References
Controls Testing Plans and Results
Risk Assessments
Risk Mitigation Plans
Audit Results

Documents needed at all levels of the Sarbanes-Oxley compliance process can be managed centrally in accordance with a companyâ€™s overall control objectives. Further, each document stored in ConTrak SOX can be associated with specific accounts, controls, control objectives, processes (and subprocesses), and risks defined in ConTrak SOX. Specific Sarbanes-Oxley compliance measures can be managed alongside the documents that support them.

Evidentiary documentation is necessary in order for internal controls to be meaningful. Essentially, controls need to have proof of their effectiveness. The most common form of evidentiary output is the audit trail. ConTrak SOX generates an audit trail of all compliance activity managed through the system including version control, rollback, and historical functions to demonstrate a complete record of control changes. ConTrak SOX automates change while providing the comprehensive audit trail on which auditors rely.

Review and approval represents the core of Section 404 compliance programs. Management systems must have robust review and approval functionality in order to be useful in providing for a consistent control environment. ConTrak SOXâ€™s review and approval functionality ensures that controls are sufficient and that company executives have accepted them for use in complying with SOX. As a Web based application, ConTrak SOX automates the review and approval process by distributing content across the company even to remote employees or satellite offices. Enterprise-wide collaboration on controls initiatives is possible, helping distributed companies to participate in controls development and management projects consistently.

ConTrak SOX enables functionality at the individual contributor level through effective RBAC. Individual employees are authorized to use ConTrak SOX, based on their roles within the organization. The specific functionality available in ConTrak SOX to employees is restricted based on the roles to which employees are assigned, ensuring the reduction of risk through excessive access rights. ConTrak SOX controls employee access, while ensuring they can use the ConTrak SOX functionality they need to contribute to the companyâ€™s overall control environment.

Summary