SOX in Telecom Industry Prepared by: Ravindra nath sharma MBA(IT) Symbiosis centre for information technology Pune Batch 2007-2009

The Sarbanes-Oxley Act An Overview

Reasons for New Legislation

Congressional Votes Sarbanes-Oxley Act Yes 522 No 3 Not voting 9 Authorizing Force against Iraq Yes 373 No 156 Not voting 12 Securities Litigation Reform Act Yes 387 No 130 Not voting 15 Legalizing Marijuana** Yes 93 No 310 Not voting 31 ** House of Representatives only

Sarbanes-Oxley Act

Yes 522

No 3

Not voting 9

Criminal Penalties Escaping from prison 1 to 2 years Kidnapping involving ransom 3 to 5 years Second degree murder 11 to 14 years Air piracy 20 to 25 years Sarbanes-Oxley Certification 10 to 20 years

Escaping from prison 1 to 2 years

Kidnapping involving ransom 3 to 5 years

Second degree murder 11 to 14 years

Air piracy 20 to 25 years

Is all wisdom coming from the US…? “ Americans will always do the right thing….. after they have exhausted all other options.” Sir Winston Churchill

Titles of the Act Public Company Accounting Oversight Board Auditor Independence Corporate Responsibility Enhanced Financial Disclosures Analyst Conflicts of Interest Commission Resources and Authority Studies and Reports Corporate and Criminal Fraud Accountability White Collar Crime Penalty Corporate Tax Returns Corporate Fraud and Accountability SOX of 2002: An Act to protect investors by improving the accuracy and reliability of corporate disclosures ………

Public Company Accounting Oversight Board

Auditor Independence

Corporate Responsibility

Enhanced Financial Disclosures

Analyst Conflicts of Interest

Commission Resources and Authority

Studies and Reports

Corporate and Criminal Fraud Accountability

White Collar Crime Penalty

Corporate Tax Returns

Corporate Fraud and Accountability

SOX: Who will be affected and how? Executives: Responsibility for financial reporting and keeping the markets informed Certifications: - 302 “Disclosure controles & procedures” - 404 “Internal controls for financial reporting” - 906 “CEO/CFO’s written statement on fairness” Implement Code of Ethics and whistleblower procedure Supervisory Board: Enhanced oversight Appointment of a “financial expert” Auditors: Independence Attestation on internal controls Definition of “internal control over financial reporting”: Encompasses subset of internal controls addressed in the COSO Report that pertains to financial reporting objectives Including controls over safeguarding assets

Executives:

Responsibility for financial reporting and keeping the markets informed

Certifications: - 302 “Disclosure controles & procedures” - 404 “Internal controls for financial reporting” - 906 “CEO/CFO’s written statement on fairness”

Implement Code of Ethics and whistleblower procedure

Supervisory Board:

Enhanced oversight

Appointment of a “financial expert”

Auditors:

Independence

Attestation on internal controls

Definition of “internal control over financial reporting”:

Encompasses subset of internal controls addressed in the COSO Report that pertains to financial reporting objectives

Including controls over safeguarding assets

SOX Overview

SOX Review - Intent of the Law Strong corporate governance. Increased accountability of executives. Strengthen anti-fraud measures. Protect public interest and restore investor confidence.

Strong corporate governance.

Increased accountability of executives.

Strengthen anti-fraud measures.

Protect public interest and restore investor confidence.

SOX Review - Intent of the Law The Bottom Line… SOX is designed to ensure public companies have controls in place over financial reporting; controls that support the assertions that are made in public disclosures of financial statements.

The Bottom Line…

SOX is designed to ensure public companies have controls in place over financial reporting; controls that support the assertions that are made in public disclosures of financial statements.

Implications of the Act on Business The Sarbanes-Oxley Act seeks to improve the accuracy and reliability of corporate disclosures by increasing supervision of financial reports and accountability of auditors. The act gives the Securities and Exchange Commission (SEC) initial responsibility for enforcing the new law and has also established a Public Company Accounting Oversight Board (PCAOB). Under the act, it will be unlawful for an accounting firm to participate in the preparation or issuance of an audit report regarding the financial statements of a company whose securities are traded in the US public markets without being registered with the PCAOB.

The Sarbanes-Oxley Act seeks to improve the accuracy and reliability of corporate disclosures by increasing supervision of financial reports and accountability of auditors.

The act gives the Securities and Exchange Commission (SEC) initial responsibility for enforcing the new law and has also established a Public Company Accounting Oversight Board (PCAOB).

Under the act, it will be unlawful for an accounting firm to participate in the preparation or issuance of an audit report regarding the financial statements of a company whose securities are traded in the US public markets without being registered with the PCAOB.

SOX Review - Effective Dates The Sarbanes-Oxley Act of 2002 was enacted by Congress on July 26, 2002. Companies were required to be compliant by various dates (based upon several factors including market capitalization, spin-off exclusions, etc.). Currently considering extending deadline for non-accelerated filers (On of after 12/31/2007 for management assessment; On or after 12/31/2008 for auditor attestation). Going forward, every public company will have to provide certifications quarterly and annually.

The Sarbanes-Oxley Act of 2002 was enacted by Congress on July 26, 2002.

Companies were required to be compliant by various dates (based upon several factors including market capitalization, spin-off exclusions, etc.).

Currently considering extending deadline for non-accelerated filers (On of after 12/31/2007 for management assessment; On or after 12/31/2008 for auditor attestation).

Going forward, every public company will have to provide certifications quarterly and annually.

SOX Review - Key Sections Section 302 (Certification): Officers of the company must make representations related to the disclosure of controls, procedures, internal controls and assurance from fraud. Officers personally responsible. Officers could be subject to criminal prosecution and fines. Unintentionally Bad Certification: Fines up to $1 Million and up to 10 years imprisonment. “ Willfully” Bad Certification: Fines up to $5 Million and up to 20 years imprisonment. Ultimately, SEC can order the company be de-listed.

Section 302 (Certification): Officers of the company must make representations related to the disclosure of controls, procedures, internal controls and assurance from fraud.

Officers personally responsible.

Officers could be subject to criminal prosecution and fines.

Unintentionally Bad Certification: Fines up to $1 Million and up to 10 years imprisonment.

“ Willfully” Bad Certification: Fines up to $5 Million and up to 20 years imprisonment.

Ultimately, SEC can order the company be de-listed.

SOX Review - Key Sections Section 404 (Internal Controls): Management must provide an annual assessment as to the effectiveness of internal controls over financial reporting; and obtain an attestation from external auditors that management’s approach was effective and that controls are effective. Annual reports will need to contain a report that: States the responsibility management has been given to establish and maintain an adequate internal control structure and procedures for financial reporting. Contains a current, point-in-time assessment of the effectiveness of that structure and procedures. The external auditor has attested to and reported on assessments made by management.

Section 404 (Internal Controls): Management must provide an annual assessment as to the effectiveness of internal controls over financial reporting; and obtain an attestation from external auditors that management’s approach was effective and that controls are effective. Annual reports will need to contain a report that:

States the responsibility management has been given to establish and maintain an adequate internal control structure and procedures for financial reporting.

Contains a current, point-in-time assessment of the effectiveness of that structure and procedures.

The external auditor has attested to and reported on assessments made by management.

SOX Review - Key Sections Section 404 Annual Assessment Management’s assessment must be based on procedures sufficient both to evaluate design and test operating effectiveness . Inquiry alone will generally not provide and adequate basis for assessment. Management must maintain evidential matter , including documentation, to provide reasonable support for its assessment and testing of both design and operating effectiveness. Any material weakness in internal controls over financial reporting must be disclosed by management in its filings and management is precluded from reporting that internal controls over financial reporting are effective if a material weakness is detected. Management must be actively involved in the assessment process ; it cannot delegate assessment responsibility to the auditor.

Section 404 Annual Assessment

Management’s assessment must be based on procedures sufficient both to evaluate design and test operating effectiveness . Inquiry alone will generally not provide and adequate basis for assessment.

Management must maintain evidential matter , including documentation, to provide reasonable support for its assessment and testing of both design and operating effectiveness.

Any material weakness in internal controls over financial reporting must be disclosed by management in its filings and management is precluded from reporting that internal controls over financial reporting are effective if a material weakness is detected.

Management must be actively involved in the assessment process ; it cannot delegate assessment responsibility to the auditor.

SOX Review - Key Sections Section 404 – A small section… … but a bulk of the work!!

Section 404 – A small section…

… but a bulk of the work!!

SOX Review - Groups that Oversee Securities & Exchange Commission (SEC) The primary overseer and regulator of the U.S. securities market. Oversees key participants in the securities world, including securities exchanges, securities brokers and dealers, investment advisors, and mutual funds. Public Company Accounting Oversight Board (PCAOB) “… a private-sector, non-profit corporation, created by the Sarbanes – Oxley Act of 2002, to oversee the auditors of public companies in order to protect the interests of investors and further the public interest in the preparation of informative, fair, and independent audit reports.” PCAOB website (www.pcaobus.org)

Securities & Exchange Commission (SEC)

The primary overseer and regulator of the U.S. securities market. Oversees key participants in the securities world, including securities exchanges, securities brokers and dealers, investment advisors, and mutual funds.

Public Company Accounting Oversight Board (PCAOB)

“… a private-sector, non-profit corporation, created by the Sarbanes – Oxley Act of 2002, to oversee the auditors of public companies in order to protect the interests of investors and further the public interest in the preparation of informative, fair, and independent audit reports.”

PCAOB website (www.pcaobus.org)

The Telecom Industry: Then and Now Telecom Service Providers (TSPs) have been guilty of misreading the extent of the communications boom, of over-projecting the demand for telecom services, and of making huge capital expenditures in the process. With the size and scale of Service Provider setups that emerged, it was necessary that there be a steady-flow of revenues and margins to sustain operations and justify the scale of investments that had been made. This translated into a requirement for an increased subscriber base and an increased ARPU (Average Revenue Per User). Further, these needed to be supplemented by a lowered cost of operation–driven by the resulting economies of scale and an optimized cost-structure from more streamlined business processes. The bust that ensued proved TSPs’ projections wrong. As a result, most providers were left with low infrastructure utilization and minimal revenues on their financial statements. Many of them had to write-off investments and eventually file for bankruptcy. The ones that survived have readjusted their payback periods and are today, looking at minimization of operating expenditure as a means to stay in business. Even the normally-indispensable R&D expenditures on Next Generation systems have been postponed indefinitely in many cases

Telecom Service Providers (TSPs) have been guilty of misreading the extent of the communications boom, of over-projecting the demand for telecom services, and of making huge capital expenditures in the process.

With the size and scale of Service Provider setups that emerged, it was necessary that there be a steady-flow of revenues and margins to sustain operations and justify the scale of investments that had been made.

This translated into a requirement for an increased subscriber base and an increased ARPU (Average Revenue Per User). Further, these needed to be supplemented by a lowered cost of operation–driven by the resulting economies of scale and an optimized cost-structure from more streamlined business processes.

The bust that ensued proved TSPs’ projections wrong. As a result, most providers were left with low infrastructure utilization and minimal revenues on their financial statements. Many of them had to write-off investments and eventually file for bankruptcy.

The ones that survived have readjusted their payback periods and are today, looking at minimization of operating expenditure as a means to stay in business. Even the normally-indispensable R&D expenditures on Next Generation systems have been postponed indefinitely in many cases

What SOX-compliance Initiatives can Effect An analysis report – outlining revenue maximization techniques for TSPs highlights that losses due to revenue leakages amount to the equivalent of 3% to 8% of total revenues, and can sometimes reach as high as 15%. Through interventions triggered by the SOX-compliance drive, TSPs will have a clear idea leakages and excess-cost imperatives. Results - a correct estimate of the financial implications can be calculated. 06/08/09 SOX in telecom indutry

Continue... Remedial processes as Flow-through Provisioning can align the data flows from different elements involved in Order Management, Inventory Management, Provisioning, Mediation and Billing. This allow more correct revenue estimations, leading to greater collections which are, in turn, reflected as higher revenue reporting. In the absence of a Revenue Assurance methodology, such revenues would have been unrealized. 06/08/09 SOX in telecom indutry

Remedial processes as Flow-through Provisioning can align the data flows from different elements involved in Order Management, Inventory Management, Provisioning, Mediation and Billing.

This allow more correct revenue estimations, leading to greater collections which are, in turn, reflected as higher revenue reporting.

In the absence of a Revenue Assurance methodology, such revenues would have been unrealized.

Continue... SOX-compliance can accelerate network-wide drives that can focus on plugging of leakage points. The top management is tempted to ‘dress up’ financial figures as a means of wooing or retaining investors. Thus Shareholders will be able to judge companies on the basis of their reporting with greater confidence. This ‘enhanced credibility’ would be achieved as a result of the focus on regulatory compliance thereby proving to be an incentive to immediate measures in on the SOX trail. 06/08/09 SOX in telecom indutry

SOX-compliance can accelerate network-wide drives that can focus on plugging of leakage points.

The top management is tempted to ‘dress up’ financial figures as a means of wooing or retaining investors.

Thus Shareholders will be able to judge companies on the basis of their reporting with greater confidence.

This ‘enhanced credibility’ would be achieved as a result of the focus on regulatory compliance thereby proving to be an incentive to immediate measures in on the SOX trail.

What Wipro is Doing? Wipro developed a thorough understanding of EWRM ( E n t e r p r i s e - W i d e R i s k Management) methodologies & the COSO (Committee Of Sponsoring Organizations) framework. 06/08/09 SOX in telecom indutry

Wipro developed a thorough understanding of EWRM ( E n t e r p r i s e - W i d e R i s k Management) methodologies & the COSO (Committee Of Sponsoring Organizations) framework.

Wish (Wipro-SOX Holistic) Compliance Framework for Telecom Service Providers 06/08/09 SOX in telecom indutry

The WiSH framework reviews the overall effectiveness of this implementation for in maintaining an organization-wide SOX orientation. 06/08/09 SOX in telecom indutry

The WiSH framework reviews the overall effectiveness of this implementation for in maintaining an organization-wide SOX orientation.

The Sarbanes-Oxley Act: In Other Words… The act is expected to translate into strict pursuance of corporate responsibility measures for companies by enforcing the following items on their to-do lists: • Certification of company reports and financial statements by CEOs and CFOs • Inclusion of an audited management report on internal controls in companies’ annual reports with an attestation from the company’s external auditor • Imposition of strict conflict of interest rules between a given company and its auditors • Enforcement of an ethical code for financial officers • Retention of all relevant audit records. To society in general and investors in particular, the act is expected to lead to faster reporting of transactions and more transparency in corporate financial statements- stemming from this enforcement of enhanced accountability within companies’ checks and controls. 06/08/09 SOX in telecom indutry

Why Sarbanes-Oxley is Relevant to Telecom Service Providers With legislation like SOX, TSPs would hence be required to check for their internal control mechanisms, prove how they ensure compliance and ensure that all reported figures present a true picture of current business. 06/08/09 SOX in telecom indutry

06/08/09 SOX in telecom indutry

Contd. Present outlook in the industry, TSPs must look at SOX-compliance as a trigger to accelerate optimization in their operations. An availability of funds in the immediate future –made possible because of implications for CxOs and the short time-frames involved – canbe used to catalyze this process. It would be worth noting that though financial figures get generated at the network (usage of services); they pass through a series of layers to get captured by Enterprise Systems before eventually getting reflected in financial reports. 06/08/09 SOX in telecom indutry

Present outlook in the industry, TSPs must look at SOX-compliance as a trigger to accelerate optimization in their operations.

An availability of funds in the immediate future –made possible because of implications for CxOs and the short time-frames involved – canbe used to catalyze this process. It would be worth noting that though financial figures get generated at the network (usage of services); they pass through a series of layers to get

captured by Enterprise Systems before eventually getting reflected in financial reports.

Contd. In turn, can be used to increase Service Providers’ RoI using a diligent approach involving a thorough understanding of: • The act and its various sections • Its effect on the business of TSPs • Its implications on systems and processes in the TSP domain 06/08/09 SOX in telecom indutry

In turn, can be used to increase Service Providers’ RoI using a diligent approach involving a thorough understanding of:

• The act and its various sections

• Its effect on the business of TSPs

• Its implications on systems and processes in the TSP domain

The Challenge Today lack of real-time integration across the TSP sub-systems is difficult today. example of such a loss is the presence of unmatched CDRs in the Provisioning-Rating flow. Such records are not reflected in customer invoices causing loss of potential revenue. Service data migration from Fulfilment to Billing in the eTOM model contributes to such leakages. 06/08/09 SOX in telecom indutry

lack of real-time integration across the TSP sub-systems is difficult today. example of such a loss is the presence of unmatched CDRs in the Provisioning-Rating flow. Such records are not reflected in customer invoices causing loss of potential revenue.

Service data migration from Fulfilment to Billing in the eTOM model contributes to such leakages.

Revenue leakage 06/08/09 SOX in telecom indutry

Contd.. 3.Increasing competition in telecommunications markets and emergence of a growing number of new services has led to a substantial increase in interconnection traffic. Service Providertie-ups with Content Providers, Application Service Providers and other Providers lead to complexities such as Bill Cycle Management with affiliate Service Providers having different billing periodicities, convergence of Invoice-ready and Message-ready billing systems. These require a focused approach to streamlining settlement processes. Hence, Revenue Settlement has become a critical issue in view of the scale of Telco operations of today. 06/08/09 SOX in telecom indutry

3.Increasing competition in telecommunications markets and emergence of a growing number of new services has led to a substantial increase in interconnection traffic. Service Providertie-ups with Content Providers, Application Service Providers and other Providers lead to complexities such as Bill Cycle Management with affiliate Service Providers having different billing periodicities, convergence of Invoice-ready and Message-ready billing systems. These require a focused approach to streamlining settlement processes. Hence, Revenue Settlement has become a critical issue in view of the scale of Telco operations of today.

Contd 4.Another problem that Service Providers frequently encounter is related to their inventory of network assets. This results in an accumulation of ‘stranded assets’ – assets that exist but are not reflected in look-ups – in the network. The inaccuracy in a typical inventory database ranges from a low of 40% to as high as 60% or more. 06/08/09 SOX in telecom indutry

4.Another problem that Service Providers frequently encounter is related to their inventory of network assets. This results in an accumulation of ‘stranded assets’ – assets that exist but are not reflected in look-ups – in the network. The inaccuracy in a typical inventory database ranges from a low of 40% to as high as 60% or more.

The Way Forward A framework to propel and support an upsurge will have to incorporate the triad of people, processes and systems while leveraging on an understanding of the core business proposition. 06/08/09 SOX in telecom indutry

Case study -1 06/08/09 SOX in telecom indutry

Case study-2 06/08/09 SOX in telecom indutry

Conclusion Benefits: Financial Management Compliance to Legislation Involvement of the Governing Board ----------------------- Solution  06/08/09 SOX in telecom indutry

Benefits:

Financial Management

Compliance to Legislation

Involvement of the Governing Board

-----------------------

Solution 

Thank You !

Thank You !