|
|
|
Features
< Back
Sarbanes Oxley : Technology : Financial Controls
Sarbanes-Oxley ?Tax? Increases in 2005
Total Savings from Automation: 26,700 Hours and $1,200,000
By
Stan Tims
|
|
Stan Tims
VP Marketing
Movaris
|
In 2004, the Sarbanes-Oxley Act ?taxed? companies in billions of dollars. To comply, companies paid for consultants and incremental staff to define and document the control environment and perform initial tests and evaluations. Now in 2005, the challenge is greater. Companies must ?operationalize? the control environment. Even after companies recognize that they may have actually over-documented the environment, the incremental need for regular testing, evaluation and remediation actually increases the overall workload for control activity management.
The outlook for 2005 gets even worse. Most companies had a fairly open checkbook to pay the ?tax? in 2004, but in 2005, the balance in that checkbook is much smaller.
Most companies borrowed staff from other departments in 2004 to help complete the work. Now, that help is going back to their real jobs, even though more work remains. In a poll of 190 companies conducted by Business Finance Magazine in March, 2005, nearly 50% indicated that they would conduct over 5,000 discrete control activities in 2005.
How can companies reduce the ?tax? of compliance in 2005, with less staff and less budget? One answer is to implement and apply advanced technology to relevant parts of the problem. Software-based systems, explicitly designed to address the ongoing needs of efficient and effective control activity management provide a method to dramatically reduce the ongoing costs of compliance and fundamentally improve financial control management.
While automation may reduce the cost of compliance in many areas, this article outlines just five areas:
• create and formally evaluate the control environment
• organize and ensure control testing
• test controls
• identify issues in either the evaluation or testing phases
• analyze and resolve the exceptions detected
This article demonstrates how a company with a mid-sized compliance effort can use automation to save 27,000 hours, and over $1 million, per year.
Save 1,750 Hours Evaluating Controls
Consider XYZ Corporation with 1000 financial controls and 10 offices worldwide. This number of controls, and the defined activities, can serve as a benchmark for all companies to measure and plan the time to spend on compliance.
To comply with Sarbanes-Oxley, XYZ developed a schedule to manage their control evaluations and testing. According to the schedule, XYZ will evaluate all controls at all 10 locations once per year. Just this yearly evaluation of controls generates 10,000 activities. After XYZ edits and finalizes their controls, they must send the controls to the process owners. To save time, XYZ batches controls as much as possible and reviews and sends them to all 10 locations simultaneously; however, XYZ still has to track the results and ensure the completion of each evaluation. By batching their controls, XYZ reduces the time spent on sending, tracking and archiving of results to only 15 minutes per control; however, with the total number of controls, XYZ will still spend over 1,750 hours, or almost 1 full man-year for evaluations.
XYZ can select from several approaches to manage evaluations. For example, XYZ can hire either outside consultants or more employees. Alternatively, XYZ can spread the work over multiple existing internal resources, increasing the burden on those resources, while consequently decreasing the time available for their normal tasks.
However, XYZ can save the 1,750 hours by implementing software that automates the tasks. For example, software can automatically send out evaluations on a scheduled basis and send reminder notices for overdue evaluations. With pre-built deadlines, the software knows if an evaluation has been completed or not, and if not, from business rules, software can escalate the overdue task to the appropriate level of management. Thus, with the proper software, XYZ reduces the 1,750 hours to zero, and almost 1 man-year in managing control evaluations.
Save 4,000 Hours Organizing Control Testing
With the first-round of evaluations complete, XYZ believes it has designed adequate controls that will protect the company from many levels and varieties of risks. However, several times throughout the year XYZ plans to test their controls to ensure that new staff members know what the controls are, as well as ensure that existing staff remember to follow the control definitions consistently.
Using level of risk as the criteria for testing, XYZ concludes that it wants to test 300 controls monthly, another 200 quarterly, and the remaining 500 low-risk controls annually. This schedule generates approximately 44,500 control test activities for the 10 locations.
To initiate the testing of the 1000 controls according to the pre-defined schedule with tools such as Word, Excel, and email, a manager at XYZ must send the test to the test performer. Assuming that the manager batches some emails and tests together, the manager, or team of managers may still have to send almost 4,000 emails.
If ten percent of the tests are late, managers may have to send 4000 email reminders until completion of all tests. Lastly, XYZ has to store all tests in an archive as evidence for auditors. If the manager works quickly, each of these discrete tasks may take only a few minutes to complete, (5 minutes to initiate tests and send reminders, 5 minutes to escalate results) but when aggregated together, the total volume of managing control tests will require over 4,000 hours, or 2 man-years.
Once again, XYZ can select from several approaches. Using internal staff or outside consultants combined with Word, Excel and email becomes an intensive manual effort. On the other hand, software that automates testing activity can eliminate the need for the two extra headcount.
As with the evaluations, software can automatically send tests to test performers on a pre-defined, scheduled basis, and track completion of those tests. For overdue tests, software can send reminders to test performers to complete the tests. Advanced software with business rules can automatically score the results of the tests, identify tests with non-compliant results, and escalate the non-compliant results to the appropriate level of management. Software can automatically archive all test results, creating a body of evidence for auditors. Thus, the proper software can manage all testing, and save a company over 4,000 hours, or two man-years.
Save 14,000 Hours Testing Controls
To complete tests of controls, the testers need instructions and reference information, such as company policies, control definitions, rules for scoring the test, and other documents. Identifying and locating these documents may take as much as 30 minutes per test. Even if locating these documents takes only 10 minutes on average per test, finding documents for 44,500 separate tests in 10 different locations will consume over 7,000 hours, or 3.5 man-years of effort.
Once again, the proper software can reduce the time required for this task to zero. Software can automatically provide links to or attach all required documents to the email sent to the tester, thus saving all the time needed to locate documents. Software can include all test instructions and even the test questions. The tester just has to read the instructions, answer the questions in the email, and submit the completed test, without ever leaving his desk. Thus, the proper software can provide all instructions and reference information and save a company 3.5 man-years of effort.
Performing the actual test with software also creates time savings. Performing the test requires following test instructions and submitting the results as a report, or email. This effort might require 15 minutes, at the minimum, per test. At this rate, completing 44,500 tests will require 11,000 hours, or over 5 man-years of effort. However, software can send test instructions and questions via email. To complete the test, the test performer answers the questions and clicks submit, which may take just 5 minutes, rather than the 15 minutes estimated above. This savings of 10 minutes per test to complete tests reduces testing time by 7500 hours, or 3.5 man-years.
The combination of using software to send instructions, reference information, and test questions via email, and clicking submit to return the test results in a savings of 14,000 hours or 10 man-years.
Save 4,700 Hours Identifying Exceptions
Each evaluation and test result will require individual inspection to determine whether the test or evaluation uncovered an issue or exception and to ensure satisfactory completion and compliant results. Thus, a manager or team of managers will have to track and inspect the 44,500 tests and 10,000 evaluations scheduled for the year for a total of 54,500 inspections. If only 5% of the tests and evaluations result in issues and exceptions, XYZ has to remediate 2725 issues or exceptions.
Assuming that inspecting each test and evaluation takes just 5 minutes, the staff at XYZ will spend 4500 hours or 2 man-years inspecting results to find for non-compliant results. Investing this time at this stage will result in fewer exceptions, easier closes, and better evidence for auditors. Once identified, escalating the 2725 non-compliant results may also take just 5 minutes, requiring the staff at XYZ to spend 227 hours initiating remediations. In other words, finding exceptions and just starting the resolution process will require over 4,700 hours, or two man-years.
However, XYZ can achieve the same benefits, of fewer exceptions, easier closes, and better evidence, with software that uses business rules and scoring to automatically identify issues and exceptions and automatically escalate only the non-compliant results. With software, XYZ saves the 4700 hours, or over 2 man-years.
Save 1090 Hours Managing Issues and Exceptions
Resolving issues and exceptions also entails thousands of detailed tasks that consume small increments of time, but when combined, become a significant time investment.
The length of time required to resolve exceptions will vary significantly depending on the complexity of the issue. Multiple factors impact the complexity, such as the number and level of accounting managers around an organization that participate in resolution, and the length of time each has to spend before satisfactory closure.
Regardless of the complexity of the issue and exception, all share the same basic tasks. Resolving each of these 2725 issues and exceptions requires tracking down the supporting information from different ERP systems, servers, email messages, and perhaps filing cabinets. At the very minimum for the simplest exception, gathering the background information will take 10 minutes. Likewise, tracking the completion of open issues and exceptions on spreadsheets and through meetings or e-mails may take at the minimum 10 minutes. Archiving the final resolution may take another 5 minutes. When combined, these activities for the 2725 issues and exceptions consume an estimated 1090 hours, or .5 man-years of effort. Note these time estimates refer to management of the issue or exception, not to the time spent designing and completing the remediation.
Software can automate all of the above tasks, reducing the time for these tasks to zero. As with control tests, software can link to or attach the relevant documents. Further, software automatically tracks issues and exceptions through to resolution, and archives completed results. Business rules define escalation paths, so that the software knows who to inform if an issue or exception remains incomplete. Thus, the proper software can track all issues and exceptions and save a company 1090 hours, or .5 man-years.
Further, on an on-going basis, not at the end of the month, quarter, or year, software can generate reports about outstanding issues and exceptions, enabling management to focus and take action to resolve remaining problems while they are current.
Total Savings from Automation: 26,700 Hours and $1,200,000
Because actual numbers of controls, tests, issues and exceptions will vary from company to company, the estimates of tasks and hours in this article serve as a planning tool. The estimates for this hypothetical company show that automation eliminates many thousands of 5- and 10-minute increments of time. Due to the sheer volume of work, these 5- and 10-minute increments rapidly add up to over 27,000 hours of work, or 13 man-years of effort, which software can manage automatically and reduce the increments to zero.
The time increments are:
| Control Evaluation
|
1,750 hours |
| Organizing Control Tests | 4,415 hours |
| Testing Controls | 14,685 hours |
| Identifying Issues and Exceptions | 4,768 hours |
| Managing Issues and Exceptions | 1,090 hours |
How much does the total of these 5- and 10-minute increments cost? Depending on the salary schedule and level of the staff members assigned to control testing, evaluation, and issue and exception resolution and management, the total cost will vary.
If half the staff members assigned to testing and evaluation receive $60,000, and the other half receive $80,000 per year, then a company will save $1.2 million year (using a fully loaded rate at 33%) through automation of these with these 5- and 10-minute tasks.
The 5- and 10-minute increments represent only the beginning of the potential savings. If many other Sarbanes-Oxley activities, such as the time and costs of generating reports, Section 404 assertions and Section 302 certifications, the time auditors spend tracking down and reviewing evidence of testing, were included in the estimates, the time and cost savings would increase further.
Forward-thinking companies will use these scenarios as a starting point, and as a high-level model to develop their own internal calculations and a long-range strategic approach to Sarbanes-Oxley compliance, based on software designed to automatically manage financial controls. Forward-thinking companies will discover that the benefits of this financial control management software extend beyond time and cost reductions, to a year-round compliance-ready state.
For a more thorough analysis of the tasks involved in Sarbanes-Oxley, or a detailed estimate of the financial return on investment derived from implementing financial control management software in your environment, please contact Movaris, at 888-800-7545, or visit www.movaris.com.
|
|
|
|
