Valuation of Employee Stock Options and Other Equity-Based Instruments

Technology Tools for Sarbanes-Oxley Compliance

Financial Executives Research Foundation

Issue Alert

September 2003

Technology Tools for Sarbanes-Oxley Compliance Purpose This report describes how some software applications may streamline the process of complying with Sections 404 and 302 of the Sarbanes-Oxley Act. Based on interviews with financial executives at varying stages of project implementation and with compliance software vendors, FERF provides a glimpse into the problems encountered and how technology can be used for resolution.

Technology can be a powerful tool in streamlining compliance with the Sarbanes-Oxley Act of 2002. As more and more software vendors promote the compliance functionality of their applications, determining your company’s specific needs and the best solutions can be time-consuming and tedious. Financial Executives Research Foundation (FERF) interviewed financial executives and software application vendors to determine how technology can be used to streamline compliance with Sections 404 and 302 of the Act. The list of software applications is not exhaustive and each is bolded for easy identification. Section 404--Management Assessment of Internal Controls With an original requirement date of 2003 and vague guidance, Section 404 appeared to be a burden. Most financial executives, especially those who had implemented the Committee of Sponsoring Organization’s (COSO’s) Integrated Framework a decade earlier, were confident that their company’s internal controls were adequate. However, the CEO and CFO who, under the Act, are required to attest to the controls' adequacy, had limited or no visibility into their company’s controls system. Further, they had limited or no quantitative assurance about the extent of controls testing. Tactically, for most financial executives, a Section 404 (404) solution could serve as a central repository for internal control documentation that would also facilitate the testing of controls by internal and external auditors and provide a portal for executive review. FERF categorized Section 404 needs and solutions based on the four steps to be completed: 1. Documenting of processes and controls; 2. Testing of processes and controls; 3. Management’s declaration of the internal control framework selected evaluate the effectiveness of their and FinancialtoExecutives Research Foundation, Inc. |controls; 1 4. Attestation from external auditors.

Documenting of Processes and Controls The first, and, for many companies, the most time-consuming phase for 404 compliance is the documentation of processes and controls. To accomplish this task, Section 404 project leaders quickly identified the need for a technology solution that would facilitate documentation collection, tracking and organization. For companies with users in multiple locations, the solution needed to accommodate all users. Thus it needed to be web-based. It also needed to aid in the organization of large amounts of information and to allow for easy review and retrieval of the information. A range of options exists from simple document sharing tools to applications developed specifically with Section 404 in mind. Paisley Consulting’s Risk Navigator was developed to assist with 404 implementation. It allows the user to identify significant financial statement accounts and identify the processes associated with the accounts. The processes and associated controls can be documented using a word processor, spreadsheet or flow-charting application and the stored information can be viewed by financial statement account, COSO framework, or location. Multiple views enable different users to retrieve the information they are seeking. For example, an external auditor may choose to view information using the COSO framework, while a plant manager may choose a location view. Microsoft Corporation’s SharePoint Portal Server, a document-sharing intranet portal developed and marketed by the company, can be used to organize internal control documentation and to facilitate quarterly updates. In fact, Microsoft uses the product internally to organize control documentation under transaction cycles (i.e. billing cycles). Livelink for Corporate Governance by Open Text Corporation organizes information into process controls. For each process control, the application allows the user to document five specific areas including risk assessment; control activities; information and communication; control team and roles; and monitoring and audit. Oracle Corp.’s Internal Control Manager product works in concert with its Tutor product. Tutor is the central location for process documentation, which is organized by process flow. The company offers Oracle ERP-specific processes that can be used to populate processes within Tutor. The application also allows a user to input customized processes using a free-form format. Once Tutor is populated, Internal Control Manager allows the user to define audit attributes, like general ledger accounts and process owners associated with each process. It also allows for identification of risks and mitigating controls. As executives progress in collecting documentation, they are finding a few important components to consider as part of their documentation—data flows and IT risks and controls. When researching Sarbanes-Oxley compliance solutions, consideration of how each application handles these components will assist in making a more informed choice. 2 | Financial Executives Research Foundation, Inc.

Miles Everson, a partner in PricewaterhouseCoopers Global Risk Management Solutions explains the importance of data flows, “Financial information that requires a high degree of judgment often comes from disparate sources within a company. The processes behind disparate sources, like models or assumptions, need to be identified, documented and tested. So a compliance tool needs to capture both the processes and the data flows producing financial statement amounts.“ The example he provides is the analysis for the allowance for doubtful accounts, a highly subjective number on the financial statements. A company may document its process as a quarterly evaluation by the collections manager, but the information that really needs to be documented are the assumptions used by the collections manager in the evaluation. Data flows can be documented and stored along with the process documentation but additional training may be required to educate process owners on the importance of data flows. IT risks and controls represent a pervasive issue for organizations today since most business processes have a large technology component. As such, they must be considered in the documentation of processes and controls, but many IT risks and controls can only be identified, documented and evaluated by an IT specialist. “One of our core [Section 404] team members has an IT background [to ensure IT issues are considered during implementation],” says Koen Van Loock, Project Leader for Section 404 at Lilly. “A general IT controls section is included in the documentation of each process and must be completed by a person with an IT background.” As with data flow documentation, IT documentation can be included as part of the process documentation. Testing of Processes and Controls Financial executives are finding little or no specific guidance on the extent of testing required for compliance with the Act. “Management will not get specific guidance for testing. It is management’s responsibility to decide what is necessary to make the assertion that controls are operating effectively,” said James DeLoach, Managing Directory of Protiviti, Inc. a provider of risk consulting and internal audit services. Protiviti encourages clients to consider a range of testing methods, from selfassessment to statistical sampling, depending on the risk and controls inherent to the process. They suggest entity-level analytics and monitoring and internal audit programs may be other sources for testing. Responsibility for completing the testing will vary also, depending on the risk and controls inherent in a process. The process owners or their supervisors may test areas with less risk while internal audit may perform tests in more risky areas. For the testing phase of Section 404 compliance, functionality available in different applications varies. Risk Navigator’s testing functionality includes a survey tool for self-assessments based on the COSO’s framework. The surveys were developed by Paisley, but can be modified or added to by the user. Process owners complete the survey, and an incorrect answer prompts them to develop an action plan and assign Financial Executives Research Foundation, Inc. | 3

the plan to a specific person. Once the action plan had been developed, it is tracked through issue tracker functionality. Open Text's Livelink provides workflow capabilities to help automate the testing process said Kevin Northover, Director of Financial Services Solutions for Open Text. In addition, Livelink allows the user to specifically measure the risk associated with a process using the “Risk Register Matrix.” The matrix measures risk based on the level of financial risk, legal risk, market perception risk, impact, and probability. The user can define other measures. Management’s Declaration of The Internal Control Framework Selected to Evaluate The Effectiveness of Their Controls The Securities and Exchange Commission’s (SEC) final rules for management’s assessment of internal controls included a requirement that management identify the framework it used in assessing the effectiveness of the company's internal controls. Criteria for suitable frameworks were outlined, and the COSO framework was specifically named as acceptable, although other frameworks exist that meet the criteria. In the U.S., COSO’s framework has been the most broadly accepted internal control standard since it was written in 1992, and application vendors continue to incorporate it into their products. Most of the applications allow for viewing processes and controls using the COSO framework, but some applications use it more intricately such as Risk Navigator, which is delivered with COSO assessment questionnaires pre-installed. Attestation from External Auditors In addition to management’s report on internal control effectiveness, the external auditor is required to express an opinion on management’s assessment. While more specific guidance may be forthcoming from the Public Company Accounting Oversight Board (PCAOB), interim guidance dictates that the auditor must perform sufficient work to see that management is using adequate controls and to test that the controls are effective. Financial managers are working closely with the external auditors to develop controls, compliance methods and procedures that the auditors find acceptable. They are also looking for the auditor to review their testing methods for adequacy. To take this one step further, many are looking to build as much automation into their processes as possible, to reduce audit fees. Open Text’s Livelink, when accompanied with an interface to a company’s enterprise resource planning system, has the functionality to track controls, like account reconciliations performed directly by the system, and report the results.

4 | Financial Executives Research Foundation, Inc.

Section 302--Corporate Responsibility for Financial Reports The SEC’s final ruling on Section 302 drove home the importance of transparency in financial filings by requiring management certification on the effectiveness of disclosure controls and procedures. In a July 30, 2003, speech, SEC Chairman William Donaldson said, “Good, honest companies should fear neither SarbanesOxley nor our enforcement. Rather, they should recognize that the improved standards that Sarbanes-Oxley mandates, and smart and fair enforcement of the laws are the right thing to do and help attract capital and investment…Successful corporate leaders must therefore strive to do the right thing, in disclosure, in governance and otherwise in their businesses.” Larger and more complex companies find this certification challenging, because some events that require disclosures occur in operational areas, far from the eye of accounting or finance. For example, when the sales department gets word that a major customer is looking elsewhere for the company’s product, it could be an event that needs disclosure, but the preparers of financial reports may never hear about it. A growing number of application vendors have responded to the need for businessprocess owners from all areas of the business to report events easily. FERF selected a few applications that, based on our understanding of their functionality, may assist in disclosure communications. Axentis LLC’s Sarbanes-Oxley Compliance Solution provides incident notification functionality so that managers can report events to a broad range of users quickly. Microsoft utilizes its SharePoint technology to communicate disclosure issues from the operating units of the organization to the Disclosure Control Committee. Another consideration is Livelink, which tracks document review and uses e-mail for automatic notification for events. The application’s workspace for online discussions and meetings could provide another means for communicating important events. Section 302 also requires that the management certification disclose any changes to the internal controls for financial reporting that materially affected, or are reasonably likely to affect, internal controls. As with the disclosure requirement, large or complex organizations may find it a challenge to get the right information into the hands of those people preparing financial reports. Software vendors have developed functionality to assist in tracking changes to controls. One example is Axentis’s application that includes functionality to track changes affecting internal controls and to make the changes available for management to view. Paisley’s Risk Navigator allows process owners to update control documentation quarterly and accumulates the changes in a central location so that a report of significant changes can be printed. Business Process Management applications may also work well for tracking changes in the internal control structure. OutlookSoft EAP provides process management functionality with versioning and status controls attached to the processes. Financial Executives Research Foundation, Inc. | 5

Communication and Training “Process owners are the front line. They own the controls and are responsible for the execution of the business processes. They are now in a position to be held accountable,” says DeLoach. Process owners come from every corner of the organization, including sales, marketing, operations and finance and, in many cases, have no idea what events require disclosures or what an internal control or mitigating risk factor is. Because of this, communication and training are essential parts of the compliance process. Many Sarbanes-Oxley applications provide communication and training tools. In Open Text’s Livelink application, each control process has a section on information and communication, which stores policies and procedures, training information and online discussions on the topics. User-developed training videos can be attached, and the application tracks individuals that have received the training. Other options for training are available from companies that specialize in the elearning or compliance applications. CorpNet Security’s MOAT (Managed Ongoing Awareness Tool) allows the user to populate the application with policies and procedures that are made available for training and testing over the Internet. As an example, a process owner in operations could read the disclosure policies, including a list of events requiring disclosure for his department. Once the review is complete, he or she acknowledges the policy or takes a test. Acknowledgements and test results are available for real-time viewing and reporting by management. Managers can run reports of employees who have not completed training and proactively remind employees of upcoming events. Sorting out the helpful from the not-so-helpful technology applications may be the first task encountered by a management team as they proceed with SarbanesOxley compliance. As with any software application project, the first stage is determining the company’s needs. Selection of an application with too little functionality may necessitate further investment, while too much functionality may result in incurring higher costs than necessary. By looking at what some companies have already done and what some vendors are offering, financial managers may make the compliance process smoother and less costly in the long run. Further down the road, Taylor Hawes, Controller-Global Platforms & Operations, at Microsoft speculates that the next generation of solutions will be based in eXtensible Business Reporting Language (XBRL)-based, “In the larger scheme, XBRL comes into play, providing an oversight, monitoring and risk assessment component and the potential to continually monitor the effectiveness, risks and issues of significant control processes and systems.”

6 | Financial Executives Research Foundation, Inc.

The following table alphabetically lists software applications included in this report and some basic information on application functionality. Individual vendors should be contacted for further information. Additionally, a FERF report titled Everything You Wanted to Know About XBRL but Were Afraid to Ask: A CFO’s Guide examines how XBRL can aid in compliance with the Act. Product Name

Vendor Name

Description

EAP

OutlookSoft

EAP is a business performance management application. It can facilitate approval process management and consolidated financial reporting.

Internal Control Manager

Oracle Corp.

The Internal Control Manager product works in conjunction with Oracle’s Tutor product, which serves as a repository for process documentation. Internal Controls Manager provides functionality to attach audit attributes – including general ledger account numbers, process owners, risk areas and mitigating controls – to processes. Process documentation can be automatically populated using standards furnished by Oracle, if a company is using Oracle’s ERP system. The product also offers functionality to upload risk and controls libraries, once purchased from PricewaterhouseCoopers or Deloitte & Touche.

Livelink for Corporate Open Text Governance Corporation

Livelink provides a compliance infrastructure using collaboration tools, auditable workflows and process controls, document and records management, email management and certification and training delivery.

MOAT

CorpNet Security

MOAT facilitates communication and training within a company. The application also tracks who has received training and provides management reporting to track training needs.

Risk Navigator

Paisley Consulting Risk Navigator serves as a repository for internal control documentation. Processes associated with significant financial statement accounts are identified and documented. The application provides a preinstalled series of COSO-based assessment questions. In addition to Risk Navigator, which is geared to Fortune 1000 companies, the company offers Focus, a tool that assists small and mid-sized companies in complying with Sections 404 and 302.

Sarbanes-Oxley Compliance Solution

Axentis LLC

SharePoint Portal Server

Microsoft Corp.

The Axentis product provides policy management capability as well as audit and assessment tools. It also includes a learning management tool to assist in communicating applicable laws and regulations throughout the organization. Axentis’ core business is compliance management applications, which include Health Information Privacy and Portability Act (HIPPA) compliance applications, and Sarbanes-Oxley. Microsoft’s SharePoint is collaboration software that assists users in organizing information and managing documents.

Financial Executives Research Foundation, Inc. | 7

Copyright © 2003 by Financial Executives Research Foundation, Inc. All rights reserved. No part of this publication may be reproduced in any form or by any means without written permission from the publisher. Financial Executives Research Foundation, Inc. is an affiliate of Financial Executives International. The purpose of the Foundation is to sponsor research and publish informative material in the field of business management, with particular emphasis on the practice of financial management and its evolving role in the management of business. Order this and other FERF publications by logging on to www.fei.org/rfbookstore/. Discounts available to FEI members and FERF donors. The FEI Research Foundation is a 501(c)(3) independent nonprofit educational organization. The Foundation relies on voluntary, tax-deductible contributions from corporations, FEI chapters and individuals. The Foundation receives no portion of FEI membership dues. Report authored by Tiffany McCann with editorial advisory by Cheryl de Mesa Graziano.

BECOME A CORPORATE SUBSCRIBER TODAY WITH A 100% TAXDEDUCTIBLE PLEDGE OF $250 TO FERF AND RECEIVE ALL FUTURE PUBLICATIONS, AS WELL AS MONTHLY TOPICAL AND ISSUE ALERTS, FREE OF CHARGE FOR ONE FULL YEAR. Additional research topics for Fiscal Year 2004 include: o Executing a Plan for Sarbanes Oxley Section 404 Compliance; o Directors & Officers Insurance; o The Reasons for Earnings Restatements; o What Drives the Value of Employee Stock Options; o A Review of 2003 MD&A Disclosures. To subscribe, access our secure Online Support Form at https://www.fei.org/rf/ secure/supportform.cfm (please be sure to include e-mail address).

200 Campus Drive PO Box 0674 Florham Park, NJ 07932-0674 973.765.1000 http://www.ferf.org

Financial Executives Research Foundation, Inc. gratefully acknowledges the following for their generosity and support in underwriting the printing of this report:

8 | Financial Executives Research Foundation, Inc.