![Teaching case
The SOX compliance journey at Trinity
Industries
Ulrike Schultze
ITOM, Cox School of Business, Southern Methodist University,
Dallas, Texas, USA
Correspondence:
U Schultze, ITOM, Cox School of Business, Southern Methodist
University, Dallas, Texas, USA.
Tel: 214-768-4265;
Fax: 214-768-4099;
E-mails: [email protected]; [email protected]
Abstract
Process and information technology changes in organizations
are not always voluntary
and motivated by strategic goals. Instead, they may be imposed
on organizations by
regulatory bodies and certifying agencies. This teaching case
focuses on one company’s
multi-year journey of making process and information
technology changes so as to comply
with a new set of regulations known as the Sarbanes-Oxley Act
(SOX). Even though SOX
compliance work focuses on designing, implementing, and
testing internal controls, these
controls are nothing but activities designed to ensure that
processes implicated in the
production of financial information are completed correctly and](https://image.slidesharecdn.com/teachingcasethesoxcompliancejourneyattrinityindu-221115171541-cb3f8c97/85/Teaching-caseThe-SOX-compliance-journey-at-TrinityIndu-docx-1-320.jpg)
Recommended
Recommended
More Related Content
Similar to Teaching caseThe SOX compliance journey at TrinityIndu.docx
Similar to Teaching caseThe SOX compliance journey at TrinityIndu.docx (20)
More from bradburgess22840
More from bradburgess22840 (20)
Recently uploaded
Recently uploaded (20)
Teaching caseThe SOX compliance journey at TrinityIndu.docx
- 1. Teaching case The SOX compliance journey at Trinity Industries Ulrike Schultze ITOM, Cox School of Business, Southern Methodist University, Dallas, Texas, USA Correspondence: U Schultze, ITOM, Cox School of Business, Southern Methodist University, Dallas, Texas, USA. Tel: 214-768-4265; Fax: 214-768-4099; E-mails: [email protected]; [email protected] Abstract Process and information technology changes in organizations are not always voluntary and motivated by strategic goals. Instead, they may be imposed on organizations by regulatory bodies and certifying agencies. This teaching case focuses on one company’s multi-year journey of making process and information technology changes so as to comply with a new set of regulations known as the Sarbanes-Oxley Act (SOX). Even though SOX compliance work focuses on designing, implementing, and testing internal controls, these controls are nothing but activities designed to ensure that processes implicated in the production of financial information are completed correctly and
- 2. that the financial representations they generate are reliable. Thus, despite its emphasis on internal controls, accounting and auditing, this teaching case provides students with insights into compliance-related process improvement and system integration in general. Journal of Information Technology Teaching Cases (2011) 1, 91–113. doi:10.1057/jittc.2011.11; published online 4 October 2011 Keywords: compliance-related process improvement; internal controls; Sarbanes-Oxley Act; systems integration I n his office overlooking the Trinity River flats in Dallas, TX, Don Collum, VP and Chief Audit Executive at Trinity Industries, was about to chair his weekly meeting with KPMG partner, Jarrod Bassman, who had been overseeing the KPMG engagement for Sarbanes-Oxley Act (SOX) compliance at Trinity since 2003. It was mid-January 2008, and the external audit report regarding Trinity’s SOX compliance for the year ending December 2007 was on the meeting agenda. Once again they could pat themselves on the back: for the fourth year in a row, Trinity passed its SOX audit without material weaknesses.1 Reflecting on Trinity’s SOX compliance journey, Don identified numerous accomplishments. In October 2003, when he first began consulting with Trinity Industries on their SOX initiative, he described the company as a ‘candidate of a company that could have had a material weakness as defined by SOX’ even though it was a highly successful, well-run and disciplined organization that consistently delivered shareholder value through growth
- 3. and had never had cause to restate its earnings. But when it came to SOX compliance, Trinity faced the same challenges that most companies did, namely a general lack of process and control documentation and evidence that controls had been performed. In addition, Trinity’s operations were highly diversified and decentralized, and their information systems were fragmented. Trinity had forgone the im- plementation of an integrated enterprise system even during the Y2K scare, citing the unique nature and requirements of its 22 business units (BUs). This meant that the company relied on its three versions of BPCS, a Business Planning and Control System, for its cost accounting and production scheduling system in its approximately 70 plants.2 Even though the different versions all ran on the AS/400 computing platform, they were nevertheless operating in seven different control environments, that is, different IT organizations were maintaining them and the implementations had been customized to varying degrees. As a result, a separate set of controls had to be developed, maintained and tested for each of these control environments. Despite these challenges, all their SOX compliance audits had identified no material weaknesses at Trinity. Further- more, the number of SOX controls Trinity tested had halved from year to year (see Table 1), thereby decreasing the compliance costs. But this was not a time on rest on their laurels. Don, who became Trinity’s Chief Audit Executive in May 2004, was aware of a number of challenges that Trinity would have to Journal of Information Technology Teaching Cases (2011) 1, 91–113 & 2011 JITTC Palgrave Macmillan All rights reserved 2043-
- 4. 8869/11 palgrave-journals.com/jittc/ tackle and he wanted to set some specific goals that would guide their SOX work for 2008. One pressing issue was the further reduction of audit costs. There was a general consensus within the audit group that the approximately 500 controls that Trinity had tested for the last 2 years represented as lean a control infrastructure as the company could muster without undergoing significant IT change. Should Trinity implement an ERP system after all? Should they try to emulate a leading global manufacturer that claimed to test only 25 controls for SOX thanks to a single instance ERP system representing global operations? Or were there other cost-reduction alternatives Trinity could pursue? Another issue related to the International Financial Reporting Standards (IFRS). It was clear that IFRS legislation would be passed in the United States; the only question was when. For Trinity, this raised questions about when and how to prepare for it. Company background Trinity Industries was born out of the 1958 merger between Trinity Steel and Dallas Tank, both struggling propane tank companies located in Dallas. W Ray Wallace, who was hired as an engineer and the 17th employee at Trinity Steel in 1946,3 became Trinity Industry’s first CEO. He led the company for 40 years, turning the struggling propane tank manufacturer into a US$2.4 billion provider of diversified products and services to the industrial, energy, transporta- tion, and construction sectors.
- 5. In July 1998, Timothy Wallace, Ray’s son, took over the helm as CEO of Trinity Industries. He joined Trinity in 1976, the year he graduated with a B.B.A. from Southern Methodist University. Working his way from the ground up and gaining first-hand experience with the various Trinity businesses provided Tim with the kind of in-depth knowl- edge he needed to lead the company and grow it into the $3.8 billion enterprise it became in 2007. Trinity manufactured freight and tank rail cars to transport dry cargo and liquefied or pressurized commod- ities, respectively, dry-cargo and tank barges, propane tanks, highway guardrail and crash cushions, and structural wind towers. Strategically, Trinity sought to hold a leader- ship position in each of its markets. Thus, Trinity Rail combined resources of the leading manufacturer of railcars in North America. Trinity’s Marine Products group was the largest manufacturer of inland barges and fiberglass covers for barges in the United States. Furthermore, Trinity’s Highway Products group was the only full-line manufac- turer of highway guardrail and crash cushions in the United States. The company also provided concrete and aggregates, which they mined themselves to the construction industry. Transit Mix Concrete & Materials Company, Trinity Materials Inc. and Armor Materials Inc. were leading producers of concrete, aggregates, and asphalt in Texas. Despite Trinity’s manufacturing focus, the Railcar Leasing group was one of its fastest growing businesses and a leading provider of railcar leasing and management services. It offered a variety of railcar leasing options, including full service, net, and per diem leases on either new railcars built by Trinity’s Rail group or railcars from the Leasing group’s lease fleet.
- 6. With manufacturing facilities in the United States and Mexico, Trinity had 14,400 employees working in 22 BUs in 2007. The BUs were grouped into five principal groups or lines of business (LOB) for financial reporting purposes: the Rail Group, the Railcar Leasing and Management Services Group, the Inland Barge Group, the Construction Products Group, and the Energy Equipment Group (see Table 2 for short profiles on each LOB). The Rail Group was the largest, employing about half of Trinity’s workforce and generating 39% of it revenues. Trinity’s leadership consistently focused on being a premier, multi-industry growth company, a vision that it generally achieved. For instance, since 2005, revenues increased by 19% a year (see Tables 3 and 4 for more details on Trinity Industry’s recent financial performance). The SOX of 2002 Enacted as a federal law in June 2002, the SOX was a response to the corporate and accounting scandals perpetrated by companies like Enron, WorldCom, and Adelphia Communications. These scandals not only cost investor’s billions of dollars, but also shook the public’s confidence in the nation’s security markets. In an act consisting of 11 sections, SOX legislated, among others, enhanced financial reporting standards for public compa- nies, officers’ individual responsibilities for the accuracy of corporate financial reports, and an oversight body, the PCAOB, to regulate public accounting companies in their capacity as external auditors. Public companies were given until December 2004 to comply with SOX. For most, this meant implementing two key provisions of the act: Section 302, which dealt with the internal certification of controls, and Section 404, which focused on the assessment of internal controls. Section 302
- 7. mandated a set of internal procedures designed to ensure accurate financial disclosure. The signing officers had to certify that they were ‘responsible for establishing and Table 1 Trinity’s SOX compliance journey by the numbers Year Controls monitored Controls tested Control owners Testing hours (internal) Testing hours (external) Total testing cost (in millions) 2004 2485 2440 516 3000 25,000 $2.5 2005 2752 1096 487 6269 6791 $1.3 2006 1882 524 328 6540 6464 $1.2 2007 2180 505 434 5915 5456 $1.0 Source: Internal Company Documentation. The SOX compliance journey at Trinity Industries U Schultze 92
- 8. Table 2 Profile of Trinity’s lines of business (2008) Trinity’s Rail Group (11 BUs) % Revenue: 39% % Operating Profit: 32% Largest manufacturer of railcars in North America Largest railcar axle manufacturer in North America Largest railcar coupler manufacturer in North America Trinity’s Rail Leasing and Management Services Group % Revenue: 15% % Operating Profit: 28% Leading provider of railcar leasing and management services Trinity’s Construction Products Group (8 BUs) % Revenue: 19% % Operating Profit: 11% Largest full-line highway guardrail and crash cushion manufacturer in the United States Leading producer of concrete and aggregates in Texas Trinity’s Energy Equipment Group % Revenue: 13% % Operating Profit: 12% Leading full-line LPG tank manufacturer in North America Leading manufacturer of structural wind towers in North America Trinity’s Inland Barge Group (3 BUs) % Revenue: 14% % Operating Profit: 17% Largest barge manufacturer in the United States Largest fiberglass hopper barge cover manufacturer in the United States Source: August 2008 Company Presentation published on Trinity website & company-internal documentation. Table 3 Consolidated income statement (2005–2007) Year ended 31 December 2007 2006 2005 (in millions, except per share data)
- 9. Revenues $3832.8 $3218.9 $2709.7 Operating Costs Cost of revenues 3091.1 2628.2 2324.4 Selling, engineering, and administrative expenses 228.9 208.1 181.2 3320.0 2836.3 2505.6 Operating profit 512.8 382.6 204.1 Other (income) expense Interest income (12.2) (14.8) (3.1) Interest expense 76.2 64.1 42.2 Other, net (14.4) (15.2) (11.1) 49.6 34.1 28.0 Income from continuing operations before income taxes 463.2 348.5 176.1 Provision for income taxes Current 110.1 57.5 43.9 Deferred 59.3 75.5 21.7 169.4 133.0 65.6 Income from continuing operations 293.8 215.5 110.5 Discontinued operations Gain on sales of discontinued operations, net of provision for income taxes of $12.2 — 20.4 — Loss from discontinued operations, net of benefit for income taxes of $(0.2) $(1.7), and $(8.3) (0.7) (5.8) (24.2) Net income 293.1 230.1 86.3
- 10. Dividends on Series B preferred stock — — (3.2) Net income applicable to common shareholders $293.1 $230.1 $83.1 Net income (loss) applicable to common shareholders per common share Basic Continuing operations $3.73 $2.80 $1.51 Discontinued operations (0.01) 0.19 (0.34) $3.72 $2.99 $1.17 Diluted Continuing operations $3.65 $2.72 $1.44 Discontinued operations (0.00) 0.18 (0.31) $3.65 $2.90 $1.13 Weighted average number of shares outstanding Basic 78.7 76.9 71.0 Diluted 80.4 79.3 76.7 Dividends declared per common share $0.26 $0.21 $0.17 The SOX compliance journey at Trinity Industries U Schultze 93 maintaining internal controls’ and had ‘designed such internal controls to ensure that material information relating to the company and its consolidated subsidiaries is made known to such officers by others within those entities, particularly during the period in which the periodic reports are being prepared’ (15 U.S.C.4 y
- 11. 7241(a)). The officers had to ‘have evaluated the effective- ness of the company’s internal controls as of a date within 90 days before the report’ and ‘presented in the report their conclusions about the effectiveness of their internal controls based on their evaluation as of that date.’ Section 404 required management and the external auditor to report on the adequacy of the company’s internal control over financial reporting. This was the most costly aspect of the legislation for companies to implement, due to the effort involved in documenting and testing manual and automated controls. Management was also required to produce an ‘internal control report’ that acknowledged ‘the responsibility of management for establishing and main- taining an adequate internal control structure and proce- dures for financial reporting’ (15 U.S.C. y 7262(a)). The report also had to ‘contain an assessment, as of the end of the most recent fiscal year of the Company, of the effectiveness of the internal control structure and proce- dures of the issuer for financial reporting.’ Managers generally adopted an internal control framework, such as COSO,5 for this assessment. 2003Q3–2004Q4: year 1 of the SOX compliance journey During the time that SOX legislation was making its way through Congress, Trinity was making significant changes Table 4 Consolidated balance sheet (2006–2007) ASSETS 31 December 2007 31
- 12. December 2006 (in millions) Cash and cash equivalents $289.6 $311.5 Receivables (net of allowance for doubtful accounts of $4.0 at 31 December 2007 and $3.8 at 31 December 2006) 296.5 252.5 Inventories Raw materials and supplies 302.6 316.5 Work in process 127.3 139.1 Finished goods 156.8 73.3 586.7 528.9 Property, plant and equipment, at cost 2849.6 2318.8 Less accumulated depreciation (779.8) (728.5) 2069.8 1590.3 Goodwill 503.5 463.7 Assets held for sale and discontinued operations 3.6 10.8 Other assets 293.5 267.9 $4043.2 $3425.6 LIABILITIES AND STOCKHOLDERS’ EQUITY Accounts payable and accrued liabilities $684.3 $655.8 Debt Recourse 730.3 772.4 Non-recourse 643.9 426.5
- 13. 1374.2 1198.9 Deferred income 58.4 42.9 Liabilities held for sale and discontinued operations 1.2 7.8 Other liabilities 198.4 116.7 2316.5 2022.1 Stockholders’ equity Preferred stock – 1.5 shares authorized and un-issued — — Common stock – shares authorized – 200.0; shares issued and outstanding at 31 December 2007 – 81.6.6; at 31 December 2006 – 80.0 81.6 80.0 Capital in excess of par value 538.4 484.3 Retained earnings 1177.8 908.8 Accumulated other comprehensive loss (61.6) (69.2) Treasury stock – at 31 December 2007 – 0.2 shares; at 31 December 2006 – 0.0 shares (9.5) (0.4) 1726.7 1403.5 $4043.2 $3425.6 The SOX compliance journey at Trinity Industries U Schultze 94 to its financial reporting processes. It reengineered financial reporting and standardized on one financial reporting system. This meant that the 22 – one per BU – financial reporting processes were replaced with one centralized process. This involved replacing the four general ledger
- 14. packages running at Trinity with one instance of Oracle Financials. It was estimated that the Oracle project saved Trinity $.5 million annually in SOX compliance expenses. In addition, Trinity developed the Accounting Service Center (ASC), which provided centralized, outsourced services for routine, organization-wide transaction proces- sing such as billing, payroll, and AP. Thus, instead of individual BUs processing their own accounts payable transactions, these accounting transactions were completed centrally and, by implication, standardized. Even though the ASC was run and operated by an independent service provider, most of its Trinity-related operations were housed on the Trinity campus in Dallas. While the co-location strengthened Trinity’s ability to assess the outsourcer’s controls, the up-front, data capture work was eventually moved to India for an additional 20% cost savings. This required an annual compliance audit by a Trinity representative at the outsourcer’s facilities in India. Even though the $28 million Oracle initiative was instigated primarily to improve reporting effectiveness, that is, facilitate more timely closing of books and improve the availability of financial information, Chas Michel, Trinity’s Chief Accounting Officer, highlighted that the project was given priority in anticipation of SOX: You knew the legislation was coming and you had kind of an idea of when. You could see it. Clearly it was going to happen. Jake Farkas, Director of Finance and Accounting, led both the Oracle Financials and ASC outsourcing initiatives. Relying on a rigorous project management approach, organizational structures like a steering committee and a
- 15. project management office (PMO), and expertise from consulting resources, both projects were successfully implemented in April 2003. Both were on time and within budget. This was a considerable accomplishment especially in light of the challenges Trinity had previously experienced with large-scale IT projects and the deep-seated resistance organizational members harbored toward outsourcing. The project team learned valuable lessons from the Oracle and ACS projects, including the importance of project management and change management. The team’s careful analysis of the financial processes in the various BUs also highlighted the lack of process and control documentation throughout the organization. It became increasingly clear that when it came to SOX compliance, Trinity had a lot of work to do. Even though he was part of the Finance organization, Jake was tapped to lead the SOX compliance project, in large part because Trinity’s internal audit group consisted of only two people. Leveraging the existing project team and the lessons learned from the Oracle and ASC initiatives, he formed both a PMO and a steering committee to oversee the project. The steering committee reported to the CFO, was led by the CAO, and its members included the BU CFOs as well as representatives from Internal Audit, KPMG, and E&Y, the external auditor. Jake secured advisory knowledge from KPMG and directed them to approach the compliance effort from a project management perspective. The KPMG team did just that and outlined the following project phases (see Figure 1 for a GANTT Chart): Project scoping
- 16. The purpose of this project-scoping phase was to build a project methodology, to develop a common language among the participants (i.e., E&Y, KMPG, and the Trinity steering committee), to estimate the project’s size and determine the right level of documentation. In order to estimate the size of the SOX project, the steering committee assessed the degree to which key processes (see Table 5 for a list of process areas) were standardized and/or 2003 2004 Q3 Q4 Q1 Q2 Q3 Complete Pilot Projects Finalize Scope Document Control Environment July ? Nov. 2003 Recommendations Nov.-Dec. 2003 Roll-out Organizational Self Assessment Dec. 2003 – March 2004 Conduct Validation Testing March –?June 2004 Management Assertion External Audit Testing Audit Committee Meeting
- 17. July 2003 August 2003 Finalize Gap Analysis and Develop June 2004 July – Sept. 2004 Figure 1 SOX compliance project plan (Q2003–Q4004). The SOX compliance journey at Trinity Industries U Schultze 95 centralized. Their analysis revealed that there were numerous processes that were conducted in multiple locations and would therefore have to be documented, controlled, and tested in multiple control environments. This information was then used to estimate the total number of hours and average FTEs required throughout the project’s life cycle. In order to gain insight into the amount of time and effort process and control documentation would require and the kinds of control gaps Trinity should anticipate, the KPMG team led pilot SOX projects in two manufacturing BUs: a Highway Safety facility in Lima and a Marine Tank- Barge facility in Madisonville. The BUs were chosen for their representativeness of different manufacturing opera- tions at Trinity and their relative difference with regard to the products they produced. Table 6 summarizes the control and gap profile that the pilots yielded.
- 18. The majority of gaps were related to the documentation of control activities such as management reviews of monthly/quarterly financial statements or reconciliations among various accounts. Project planning, tool set-up, team identification, and training This phase saw the fleshing out of the project GANTT chart and included a process risk assessment for individual BUs to prioritize processes and controls for documentation. In addition, KMPG helped Trinity build and populate a database application. This application served as a central repository for all SOX controls and allowed Trinity to track each control’s testing history and any changes made to it over time. Although the descriptions of the controls were published on the Trinity intranet, their history and testing status were not. In this phase, KPMG also assisted the steering committee in developing and training the documentation teams on the templates they would be using for the project. The three primary documents were flowcharts and matrices for controls, and gap-analyses. In addition, a control catalog that outlined a numbering scheme for controls by specific processes was developed. Since each of the BUs would document their own processes and controls, the catalog numbering scheme would help identify and organize the controls. Table 5 Process areas for SOX compliance (2004) Routine transactions Non-routine transactions Manufacturing operations Restructuring Inventory operations Legal Leasing/finance operations Acquisitions and divestitures Mining operations Regulatory
- 19. Contract operations Self-insurance Revenue and AR Benefits and pension plan adjustments Expenditure and AP Asset impairment Payroll Intangibles/goodwill impairment Capital expenditures Treasury Financial reporting Taxes Closing Consolidation Information technology Journal entries IT control environment Disclosure and presentation Control environment Fraud prevention and detection Control environment Fraud prevention/detection Table 6 Pilot control and gap profile Highway safety Tank-barge Total key controls 83 67 Preventive controls 65% 55% Detective controls 35% 45% Manual controls 75% 86% System controls 25% 14% Total control gaps identified 13 19 Gaps related to documentation 9 15 Key controls: controls that pertain to SOX compliance; Preventive control: controls that prevent a mistake from happening, for example, check customer’s credit before authorizing a sale; Detective control: control that detects a mistake after it has happened, for example, reconciling bank account; Manual control: control completed by a person, for example, reviewing and signing a document; System control:
- 20. control automatically completed by a computer system, for example, matching electronic purchase order to electronic delivery notice. The SOX compliance journey at Trinity Industries U Schultze 96 Documentation of processes and controls Having identified where in the organization each of the key processes were performed and controlled, that is, at Corporate, ASC, Group or individual BU, the documenta- tion of processes and controls began. This work fell to documentation teams consisting of KPMG advisors, mem- bers of Trinity’s internal audit group, and BU controllers. The team would interview the organizational members to understand their processes and controls. These were then documented in flowcharts and control matrices, and shared with the organizational members for correction and feed- back. The focus of this project phase was to identify the AS– IS state of processes and controls through a bottom-up analysis of the organization’s work practices. Comparison of controls and expectations to identify gaps Although the documentation phase had focused on the AS– IS processes and controls, the documentation teams had nevertheless noted gaps between the AS–IS practices and a SOX-compliant (or TO–BE) way of operating. In this fourth project phase, the documentation teams focused on these gaps by completing gap-analysis matrices for controls with gaps. A control gap might be the lack of corrective controls around inventory adjustments, for example, adjustments made to the BPCS system after a physical stock count. A documentation-related control gap might be noted if an employee initialed a checklist as evidence that all the
- 21. transactions on the checklist, for example, a number of reconciliations, had been completed. For proper evidence that the control activity had been completed, each transaction (or reconciliation) had to be initialed sepa- rately. In addition to describing these gaps, the gap-analysis template required the team to note additional control activites that would mitigate the risk of each control gap, an indicator of the impact’s severity (i.e., high, medium, or low), and a recommendation for dealing with the control gap. Also, instead of just documenting the gaps, the team also began remediating them whenever possible. As many of the gaps were documentation related, remediation frequently took the form of educating the control owners in the evidentiary expectations of SOX-related documenta- tion. By mid-December 2003, the gap analysis had identified 1249 control activities and 265 gaps. Of these gaps, 172 were related to documentation and none of them were classified as high priority. Self-assessment and test plan design In order to support management’s assertion regarding the effectiveness of internal controls, Trinity had to create a self-assessment process that would increase accountability. This process assigned and managed control owners for every control at perpetuity. The steering committee designed a process whereby Control Certification Letters (or ‘Representative Letters’) were automatically generated and mailed to each control owner on a quarterly basis. These letters asserted that the control owner was accountable for the effectiveness of the internal control assigned to him/her. Depending on
- 22. reporting structures, these letters needed to be signed and returned to the BU controllers, the Group CFO or the internal audit department. This process was effective at tracking changes in control ownership as it regularly alerted Trinity if control ownership responsibilities had not been reassigned as people left the company or changed jobs, for instance. As part of test planning, the steering committee oversaw the classifications of control activities into A, B, and C controls. ‘A’ controls were key or primary controls that would always be tested for SOX compliance. ‘B’ controls represented back-up controls that Trinity would rely on when the primary controls failed. ‘C’ controls were controls that were related, but not central, to SOX compliance. In June 2004, Trinity’s 1573 control activities broke down as shown in Table 7. Control redesign to close gaps In order to remediate the gaps identified, the documenta- tion teams worked with Corporate, the BU controllers and the Group CFOs to gain agreement on each gap, its impact and mitigating control activities. Then they developed an action plan for correcting each control gap. This plan addressed what corrective action needed to be taken, who was responsible for gap closure and when it was going to be implemented. Gap closure was being monitored on an ongoing basis by the steering committee that met weekly during the course of 2004. Furthermore, gap closures would be validated during the internal validation testing planned for March to June 2004. By end of June 2004, all except three of the 280 documentation gaps had been closed. Training The steering committee sponsored four levels of training:
- 23. (i) high-level guidance on SOX for senior executives, (ii) training on COSO for the 50–70 controllers in Trinity, (iii) SOX documentation training for the various documentation teams, and (iv) control owner training. This training phase was also a part of the change management activities that most large-scale, organization- wide projects require. However, Jake Farkas noted that there was one key difference between a regulatory project such as SOX compliance and an organizational process improvement initiative like the Oracle and ASC projects: since the former were compulsory, there was less need to convince people of the urgency and necessity of a change. Even though there was a considerable need to educate the members of the organization, particularly control owners, on the documentation and evidentiary requirements for SOX, in contrast to the Oracle and ASC projects, Trinity did Table 7 Control classification (2004) Control classification Count ‘A’ controls 649 ‘B’ controls 397 ‘C’ controls 705 Unranked controls 70 The SOX compliance journey at Trinity Industries U Schultze 97 not feel the need to hire a full-time change management consultant for the SOX project. Monitor – test of control and/or control self-assessment
- 24. This project phase represented the internal audit phase of the SOX compliance audit. Not only were the control activities tested, but so was the self-assessment process. By the end of June 2004, 1803 control activities had been tested and 284 testing gaps were identified, of which 226 were closed. The causes of these gaps were fairly evenly split between issues of operating effectiveness and documen- tation. Common testing gaps related to the lack of maintenance of the SOX binders that had been created for each control, insufficient evidence of timely reviews, insufficient exercise of change controls, and a ‘check the box’ mentality (rather than a fulfillment of the spirit of the control). By the end of the year, 2440 controls had been tested and 327 testing gaps had been identified. Management assertion Right from the beginning of the SOX compliance project, Trinity had set a target for being in a position to complete the management assertion by 30 June 2004, even though the assertion was only due on 31 December 2004. This early deadline would give Trinity an opportunity to fix any key weaknesses identified during the course of preliminary testing by the real deadline. External auditor evaluation and attestation of internal controls Even though the external auditor only started testing in Q32004, the SOX steering committee included a represen- tative from E&Y. Trinity thus had the benefit of E&Y’s interpretation of the SOX legislation throughout their decision-making. This was particularly important in light of the fact that SOX provided little guidance and the public accounting companies were developing the standards for SOX compliance in an emergent fashion and by comparing their standards of control effectiveness with their compe- titors. For instance, when PwC announced that spread- sheets needed to be password-protected in order to pass a
- 25. SOX audit, there was much consternation at Trinity until E&Y took a clear stance on what they would deem an effective spreadsheet control. The results of E&Y’s external audit testing revealed no material weaknesses, but 14 deficiencies.6 2005: year 2 With the first year of compliance successfully behind them, the SOX project was moved into the audit organization, which had grown under Don Collum’s leadership. It was clear to Don and the SOX steering committee that there was much room and need for improvement for their second round of SOX assessment. While Trinity had adopted a ‘get it done’ and ‘brute force’ attitude in the first year of compliance, it was clear that their approach of document- ing and testing ‘every control known to man’ was not going to be feasible in the long term. Like so many other companies, Trinity believed that they had ‘over-audited’ and ‘over-tested’ in order to avoid material weaknesses, since ‘failure was not an option.’ Now, it was time to ‘step back, look at it, and do a better job at risk profiling.’ In order to prepare Trinity for its second year of SOX compliance, the steering committee focused on two initiatives: (i) a top-down, risk-management approach to testing, and (ii) the streamlining of controls across BUs. Together these initiatives halved the number of SOX control activities Trinity tested in 2005. The risk management method to testing implied a shift from a ‘shotgun’ to a ‘rifle’ approach. Trinity would not test all controls but identify areas that were material and posed a threat to the financial statements. Only significant processes and major classes of transactions in these
- 26. processes would need to be audited for SOX. Trinity thus sampled BUs that contributed at least 5% to Trinity’s revenues or represented at least 5% of Trinity’s assets as per the company’s consolidated financial statements. Only control activities in significant processes in those BUs would be tested. One implication of this risk-oriented approach was that it reduced the number of control activities designated as key or ‘A’ controls in part because their definition focused more on what risks these controls posed for material misstate- ments of the company’s financial results. Furthermore, not all ‘A’ controls would be tested every year, because they might be located in BUs that were not significant enough to be audited. Similarly, ‘C’ controls were no longer seen as relevant for SOX compliance because the audit group did not anticipate ever testing them for SOX. Nevertheless, these ‘C’ controls could be maintained and tracked on the SOX database if the BUs so wished. Some BUs saw symbolic value in designating certain control activities ‘SOX controls’ as this made their enforcement easier. The second year-2 initiative focused on process improve- ment. The SOX steering committee created process improvement teams and charged them with streamlining, standardizing and automating the control activities for a given process (e.g., inventory, AP, AR). Georgia Papageorge, VP Finance and Accounting in the Freight Car Group, led the inventory process improvement team. The team consisted of about seven members and included represen- tatives of the BUs, KPMG, and the internal audit group. In order to streamline the inventory-related control activities, the team analyzed each BU’s control documenta- tion. They found considerable overlap and variability in the way the controls were described. Most of the variability
- 27. arose from the different systems that were operating at the BUs. A report that one BU relied on for its controls was not available in another, for instance. Furthermore, the same control activities might be worded differently, such as ‘the BU controller reviews this, vs the accounting manager reviews this, vs accounting personnel reviews this.’ In order to standardize the controls, the process improvement team abstracted the control description so that it was universal enough to cover the control activities in the various environments. The team also looked for redundant control activities. Some BUs relied on multiple controls to accomplish the same objective. By looking across BUs, it was relatively easy to identify these redundant control activities and to determine best practices that could then be replicated across BUs. Overall, this process improvement effort took The SOX compliance journey at Trinity Industries U Schultze 98 about 3 months and reduced inventory controls by about 25%. Its biggest achievement was to bring consistency to inventory controls such that each BU relied on the same control despite operational differences related to unique products and IT infrastructure. A closer look at the inventory process of the Trinity Rail Car group provides some detailed insights into the improve- ment team’s work. A flowchart of the 2004 inventory management process is presented in Figure 2. Table 8 provides the accompanying control matrix. The latter highlights the overlap of control objectives within the inventory process in this single LOB. For instance, controls
- 28. 3, 4, and 13 all dealt with the correct valuation and recording of inventory. Furthermore, different plants relied on different variations of control #14. Figure 3 and Table 9, which show the inventory process flowchart and control matrix for 2005, illustrate the inventory improvement team’s efforts. In particular, the controls were uniquely numbered and described in more universal terms. However, as best practice controls were applied to all plants, there was an initial increase in the controls in Freight Car operations in 2005. Only after the inventory team’s recommendations to eliminate some controls were put into effect in 2006 (see Table 10 for summary), did the Freight Car see a decrease in controls maintained and tested. In 2007, as more plants were added to the Freight Car group and more plants became signi- ficant for SOX compliance, the number of controls main- tained and tested went back up. Table 11 highlights the number and breakdown in controls maintained and tested in Freight Car between 2004 and 2007. Internal testing in year 2 brought a new set of challenges to light: Trinity’s IT group seemed unaware that SOX compliance was a new reality and not a one-time effort. Kasey Nash, a KPMG senior manager on the Trinity SOX project, recounted the reaction from the IT group when they came to test in 2005: ‘You’re back again? You mean we still have to do this?’ SOX compliance had not been given the necessary priority in the IT department and this led to the identification of 48 gaps in IT control activities.7 These gaps included privileged and programmer access rights for core systems like BPCS and the on- and off-boarding of
- 29. Trinity employees, which included managing their access rights to networks and applications. While the 48 gaps were an improvement on the 20% error rate of IT controls in 2004, it was September 2005 by the time they were identified. This did not give the IT group much time to remediate them. The IT environment was also challenging due to its distributed nature. There was a corporate IT group that was primarily responsible for infrastructure technologies (e.g., networks, Internet, email), IT groups within the BUs that supported business-specific applica- tions, and IT support in Mexico and Europe. These different control environments multiplied the controls that needed to be maintained and tested. Furthermore, nine applications (including Oracle, Peoplesoft, BPCS) plus the network were in scope for SOX compliance. In November 2005, Terri Wilson, Analyst in IT’s Strategic Compliance Services, replaced the previous IT SOX manager. Determined not to fail as it could cost her job, Terri learned what she could about SOX compliance. She became aware of ISACA8 in 2006. She subsequently joined the organization, attended local chapter meetings regularly, and even earned her CISA9 certification. 2006: year 3 While the first 2 years of SOX compliance had been guided by a project management approach, it became increasingly clear to Don Collum and other members of the steering committee that Trinity needed to move beyond ‘the SOX project’ and put in place a ‘governance process.’ This meant that their language and mindset needed to change. The controls needed to become so deeply embedded in Trinity’s processes, that they were indistinguishable from people’s sense of ‘good business practices.’ Thus the ‘SOX’ designa- tion, for example, ‘SOX steering committee’ and ‘SOX
- 30. controls,’ was dropped and new labels such as ‘governance steering committee’ and ‘financial controls’ emerged. One of the controllers described life with SOX as follows: You are audited constantly; you just have to have perfection in your job. There is no room any more for any sort of margin of error. We have to make sure that our revenue recognition is accurate. We have to make sure that we have controls and that people are doing them. We work for a public company. We are audited almost daily; so there is a little more pressure with making sure that we have seasoned people in positions who understand what they are doing. Or even if they are not seasoned that they know the rules and follow them; that they understand they are going to be audited quarterly, monthly, daily. It is all about accountability. Even though they acknowledge that SOX was ensuring that they were doing what they ought to be doing anyway, the controllers maintained that their SOX responsibilities added at least 8–10 h a month to their workloads.10 The extent of the additional work depended on the number of controls they owned and the number of paper binders11 they needed to maintain. Indeed, Mike Mason, CFO for the Construction, Energy and Marine Group, voiced his frustration with an audit process that hampered organiza- tional efficiency: How do I change the audit process, not the control process? Because I’ve done the control, it’s there, and it’s available. The problem is now to explain to the auditors that it’s done. Because they want it nice and neat, in a stack of papers, and then ‘walk me through because I’ve been out of school for a whopping 6 months and I don’t
- 31. understand your business.’ So I am just catering to the audit side of the control. In order to change group and BU controllers’ perception of SOX, Don promised them that, ‘if you can show me a control that we are doing solely because of SOX, I will let you quit doing it. If there is no business reason to do it, quit doing it.’ Don also stressed one of the key benefits of SOX compliance, namely that they no longer had to spend time The SOX compliance journey at Trinity Industries U Schultze 99 Figure 2 Flowchart of Trinity’s Freight Car inventory management process (2004). The SOX compliance journey at Trinity Industries U Schultze 100 T a b le 8 C o n tr o
- 94. u al ly The SOX compliance journey at Trinity Industries U Schultze 101 T a b le 8 C o n ti n u e d C la ss O pe ra ti
- 154. re p o rt s Q u ar te rl y The SOX compliance journey at Trinity Industries U Schultze 102 In ve n to ry is u n d er
- 220. p la te an d la b o r M o n th ly The SOX compliance journey at Trinity Industries U Schultze 103 T a b le 8 C
- 274. n ew ch ec k li st it em to b e ad d ed to F .5 0 D ai ly The SOX compliance journey at Trinity Industries U Schultze
- 275. 104 assessing the reliability of their information, which allowed them to spend more time on activities that required judgment and estimation, such as warranties, taxes, and inventory. Trinity also started to benchmark their SOX processes and controls with other companies in their industry to identify additional opportunities for reducing their controls and streamlining their SOX testing. Mike Mason explained that they went to one of their peers to learn about their system access control processes. He found that even competing peer companies were open to sharing knowledge around SOX because they saw no advantage to keeping their SOX-related processes secret. A peer’s SOX failure was not seen as a victory: It just puts a fear factor, at least in the finance world, of ‘they got caught on something, maybe I’m going to get caught on something.’ It’s almost like nobody wants anybody to get into trouble for SOX, because that just means we’re all going to get in trouble for something. It’s almost like you want everybody to win and for everyone to be doing SOX okay. In IT, Terri Wilson led a control streamlining effort similar to the one that the process improvement teams had done in the BUs in the prior year. Her analysis highlighted duplicate controls caused by inconsistent numbering and wording. She also found that some controls had multiple control owners. Her efforts reduced IT’s controls from 92 to 39.
- 276. She also categorized the IT controls into a categorization scheme that resembled COBIT,12 of which she was unaware at the time (see Table 12 for the categories and control samples). This process improvement effort led to not only a reduction in IT controls, but also a reduction of IT control gaps over time as Table 13 demonstrates. 2007: year 4 In the fourth year of SOX compliance, the number of control activities tested stabilized. There was a general sense among the members of the governance steering committee that Trinity’s SOX control infrastructure was as lean as it could be. Furthermore, they felt that their self- assessment and change control processes were robust and sustainable. For instance, they had established the following change control procedure for SOX controls: � When a BU wanted to make a change to a SOX control, for example, replace a control owner, change the control description, or replace a manual control with an automated one, a change request was sent to the internal audit group, where it was reviewed by the SOX Program Manager, Rhonda Krasselt. � Depending on the change, either Rhonda Krasselt or Don Collum reviewed the change. They explained that as long as a proposed control effectively met a necessary control objective, they were likely to approve a con- trol change. Once final approval had been granted by Don, the change was forwarded to the SOX adminis- trator, who maintained the SOX database, which tracked all changes. ap p
- 310. d ar d Se m i- an n u al ly The SOX compliance journey at Trinity Industries U Schultze 105 � Periodically, the governance steering committee was informed about the SOX control changes that had been made. On average, about 1000 SOX changes were made every 6 months. Changes to control activities were also made in response to new business processes and gaps that had been identified during testing. Rhonda Krasselt noted that, at times, it was difficult to convince BU staff to document their controls. They did not want to have to ‘sign off on more things’ and
- 311. were reluctant to give the audit department ‘more things to gap them on.’ This sentiment seemed to express a ‘fear of the gap.’ Increasingly, the governance steering committee got involved in screening proposals for organizational change initiatives such as system upgrades or process improve- ments. This screening sought to identify the SOX implica- tions of a proposed change, but it also sought to leverage business-driven initiatives in order to improve Trinity’s control environment. Thus, while it was difficult to make a business case for implementing systems and process changes for the purpose of reducing SOX compliance costs, improvements that served more strategic objectives could be used as a vehicle to achieve this goal. For instance, when Trinity was planning to implement a new time reporting system for payroll, the steering committee looked for ways to improve the timesheet approval process and to store the Figure 3 Flowchart of Trinity’s Freight Car inventory management process (2005). The SOX compliance journey at Trinity Industries U Schultze 106 approval information electronically without compromising its auditability. Pondering the next phase of the compliance journey In early 2008, as Don Collum was getting ready for his meeting with Jarrod Bassman, he mulled over the Trinity’s SOX compliance journey, its victories and ongoing challenges. There were numerous victories. Chief among them was that their external auditor, E&Y, never identified
- 312. any material weaknesses in Trinity’s financial reporting processes. Trinity also decreased the cost of SOX com- pliance every year, even though the number of controls they tested had stabilized. In addition, they developed a system of accountability that clearly identified and tracked control owners. They also implemented governance structures such as the SOX steering committee, which was now actively involved in monitoring any organizational change with implications for Trinity’s internal controls. Any changes to processes related to financial reporting were being mana- ged. Lastly, there was a general acknowledgement in the organization that internal controls made business sense and that they were helpful to the organization. For instance, they sustained disciplined operations and provided more confidence in the data that various operational and financial processes generated. Nevertheless, there were questions about the next steps in Trinity’s SOX compliance journey. How could they continue to reduce the costs of compliance given that the number of SOX controls they tested was as lean as was possible given the company’s relatively decentralized IT infrastructure? Many SOX controls were manual. Was it time to invest in a company-wide, single-instance ERP system, a strategy that many global manufacturing firms had pursued? How could such an investment be justified? Or were there ways of leveraging the information technology that Trinity already had to automate some of their many manual controls? For instance, BPCS was increasingly marketed as an ERP system for manufacturing organizations as it integrated cost accounting, planning, distribution, and manufacturing functionality. However, BPCS had not been implemented in a way that the standardization of processes and centralization of controls afforded by ERP systems could be leveraged. Not only
- 313. was Trinity running three different versions of the BPCS software, they were also relying on different IT organi- zations to support them. In addition, many BUs had customized the software to produce the kind of output they needed to calculate Cost of Sales, Overhead and Labor Rates, among others, in their homegrown spreadsheets. In other words, instead of automating the interface between BPCS, which essentially served as a sub-ledger, and Oracle Financials, Trinity’s general ledger, the BUs downloaded customized data from BPCS, manipulated it in Excel and then based their manual general ledger journal entries on these spreadsheets. As a result, BPCS operated in seven different control environments, which multiplied the number of controls that needed to be developed, main- tained, and tested. In addition to standardizing processes and centralizing controls by integrating systems, were there other strategies that Trinity could rely on to further reduce the cost of SOX compliance? For instance, could the hours internal auditors spent on control testing be reduced? Were there ways in which the cost of ‘catering to the audit side of the control’ could be decreased? At the same time, there were questions about the integrity of the control infrastructure as a whole. As Trinity only tested A controls for SOX, was there a danger that B controls, which were supposed to serve as back-ups to A controls, would fail compliance tests? Furthermore, many Figure 3 Continued. The SOX compliance journey at Trinity Industries U Schultze 107
- 391. The SOX compliance journey at Trinity Industries U Schultze 108 A P la n t R ec o n ci li at io n 9 In ve n to ry is
- 473. en t re vi ew D M B U C o n tr o ll er The SOX compliance journey at Trinity Industries U Schultze 109 of the A controls assumed that C controls were in place. What if they were not? Without testing them periodically, how could Trinity be assured that there were no weaknesses in its control infrastructure? Lastly, there was the question about the inevitable move
- 474. to the IFRS. Even though it was unclear when the Security and Exchange Commission would require companies to report their financials under the international standard (deadlines ranging from 2011 to 2014 were rumored), it was certain that public companies would have to embark on another major compliance-motivated process and infor- mation technology change in the near future. How well prepared was Trinity for this change? How could the governance, information technology, and process infra- structures that had been developed as part of SOX compliance be leveraged for this imminent transition? In 2008, there was much discussion about the differences between the US GAAP (Generally Accepted Accounting Principles) and IFRS. The international standard was frequently described as more principles-based than the rule-based GAAP. For instance, US GAAP contained a number of rules for classifying leases, whereas IFRS took a more holistic approach to lease classification, relying on accountants’ professional judgment to make a classification based on the substance of a given lease agreement. As principle-based frameworks make different interpretations of similar transactions possible, transitioning to IFRS had implications for an organization’s control activities. Given that controls were designed to ensure compliance with rules, a change in the underlying logic of lease classifica- tion, for instance, was highlight likely to require adjust- ments in a company’s control activities. In addition, the experience of companies in regions of the world that had already converted to IFRS (e.g., Europe, Australasia, Latin America, and Africa), highlighted that the implications of moving to the new accounting standard was at least as great for companies’ information systems as it was for their accounting practices and internal controls. The need for new data, as well as changes in calculations
- 475. and reporting required by IFRS, would ultimately have to be implemented in a company’s information systems. For this reason, some estimated that over 50% of IFRS conversion costs were related to IT.13 An example of the different ways in which US GAAP and IFRS treat fixed assets illustrates the IT implications of transitioning to the new accounting standard. Under GAAP, the total cost of a building was capitalized and depreciated over the life of the structure. The flow of information for this transaction was as follows: the real estate system fed the building cost to the fixed asset system, which then calculated the depreciation and fed it to the general ledger. In contrast, under IFRS, a building was decomposed into different asset components, for example, building, roof, fixtures, each of which was then depreciated over its useful life, for example, 40 years for a building, 10 years for a roof and so on. Thus, the real estate system would need to track and allocate the building cost to different compo- nents, and the fixed asset system would need to depreciate assets at different rates. These information systems would therefore not only need to accommodate new fields, but also new calculations, as well as new system and user interfaces.T a b le 9 C o n ti n
- 498. ls M an ag er The SOX compliance journey at Trinity Industries U Schultze 110 T a b le 1 0 In v e n to ry m a n a g e m