Need For Corporate Governance

The Importance of Governance In a Regulatory World Dwayne Jorgensen, CIA, CFE Consultant, Governance Services Spirit Consulting Services

Agenda Introduction/Sarbanes-Oxley Brief history Human nature and the need for governance COSO overview Your role Spirit or Letter of the Law? A Risk-based approach… Q&A

The Cost of Poor Governance: Sarbanes – Oxley in a Nutshell The Act was signed into law on July 30, 2002 and includes eleven titled sections: Title I Public Company Accounting Oversight Board Title II Auditor Independence Title III Corporate Responsibility Title IV Enhanced Financial Disclosures Title V Analyst Conflicts of Interest Title VI Commission Resources and Authority Title VII Studies and Reports Title VIII Corporate and Criminal Fraud Accountability Title IX White Collar Crime Penalty Enhancements Title X Corporate Tax Returns Title XI Corporate Fraud and Accountability

Brief History Thanks to Enron and the “.com implosion,” Governance became an issue COSO’s Framework of Internal Control was published in 1992, but did not prevent the need for the Sarbanes-Oxley Act… Why? COSO was left “voluntary,” and therefore was essentially ignored for ten years by the business world, until made mandatory by the Sarbanes-Oxley Act.

Human Nature -The Need For Governance Maslow's Hierarchy of needs “ Self-Awareness” is a desired, not required state. Behavior styles and business management Governance tends to be viewed as “overhead,” and has historically been minimized on a “cost/benefit” basis. Why is governance important? Curiosity, greed, self-rationalization and pride, the key elements of control breakdowns in historical business cases.

Human Nature The Need For Governance The Competency Square Unconsciously incompetent Consciously incompetent Consciously competent Unconsciously competent

Human Nature The Need For Governance Unconsciously incompetent Consciously incompetent Consciously competent Unconsciously competent

COSO - Overview COSO Definition of Internal Control Internal control is a process, effected by an entity’s board of directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: Effectiveness and efficiency of operations Reliability of financial reporting Compliance with applicable laws and regulations Key Concepts Internal control is a process . It is a means to an end, not an end in itself. Internal control is effected by people . It’s not merely policy manuals and forms, but people at every level of an organization. Internal control can be expected to provide only reasonable assurance , not absolute assurance, to an entity’s management and board. Internal control is geared to the achievement of objectives in one or more separate but overlapping categories.

Risks Evaluated by: Severity Likelihood Types of risks: Inherent risks Managed risks Residual risks COSO - Overview

COSO – Overview Dwayne’s “Hierarchy of Internal control needs” (First published 1990): Control Self-Assessment Consulting Operational Compliance Proactive Reactive

COSO – Overview Hierarchy of internal control needs – revised (2004) New Foundational Layers: CSA Consulting Operational Compliance Proactive Reactive Objectivity Independence

Your Role as “Teacher” Who is responsible for implementing the Internal Control Framework? Management Who should be responsible for overall Governance? Not your external auditors What is the preferred solution? Senior management and internal auditors as teachers of Internal Control

Your Role as “Teacher” Internal control expertise can provide assistance in every layer of the cube Reactive Proactive Compliance Operational Consulting CSA

Your Role as “Counselor” Why should management, internal and external auditors communicate? Ensures company assessments, documentation, testing and reporting are correct Lightens attestation load for external auditor (SAS 65)

Governance: Spirit or Letter of the Law? Sarbanes-Oxley: The “end” or “means?” Act originally thought limited in life, now basis for many global governance initiatives Positive/negative effects of the intent for creating the ideal control environment Too much focus on “letter of the law” (reporting requirements) than “spirit” (corporate governance) Ongoing debate over role of External Auditor Act was direct result of audit firms acting as consultants, yet lines are still blurred on using external auditors for consulting needs. “ 4 – 3 – 2”

Spirit or Letter of the Law? Section 404 Can external auditors “independently” test and opine on management’s report on internal controls if they played any role in preparing the document? 4 - 3 - 2

Spirit or Letter of the Law? Section 302 Is management comfortable with this decision in light of pending guidance on disclosure protocols, and the subsequent potential harm if something was deemed “inappropriate” about the external auditor’s role at a later date?” 4 - 3 - 2

Spirit or Letter of the Law? Section 201 Since this assistance of operating management in preparing their assertion falls outside the scope of actual external audit work, does it require audit committee approval, and is management therefore comfortable asking for it? 4 - 3 - 2

In the true “spirit” of the Act… Independent Internal Audit (IA) function Board-approved charters Risk assessments – management & IA Key Controls Determined by management assessments Audit plans developed based on output of assessments Testing and reports of effectiveness by IA Correction of deficiencies by management Management/IA as “teachers of internal control” Management/IA as part of continuous improvement process

In the true “spirit” of the Act… Thought-leading organizations were doing most, if not all, of the previous prior to the Act, and were not even necessarily publicly traded!

COSO – ERM Framework Have You Started Yet?

Enterprise Risk Framework Four objective categories – Strive to achieve Eight components – Needed to achieve Entity and organizations units

Enterprise Risk Framework Is a process - is a means to an end, not an end and itself. Is effected by people- is not merely policies, survey and forms, but involves people at every level of an organization. Is applied in strategy setting. Is applied across an enterprise, at every level and unit, and includes taking an entity-level portfolio view of risks. Four objective categories-Strive to achieve Eight components-Needed to achieve Entity and organizational units

Enterprise Risk Framework Is designed to identify events potentially affecting the entity and manage risk within its risk appetite. Provides reasonable assurance to an entity’s management and board. Is geared to the achievement of objectives in one or more separate but overlapping categories Four objective categories-Strive to achieve Eight components-Needed to achieve Entity and organizational units

The Compliance Iceberg Industry Compliance Standards

Who’s Watching the Store? Frequency Responsibility Role Annually Periodically Ongoing COSO Quarterly Quarterly Quarterly SOX 302 External auditors Internal auditors Management Annually Validators independent of company Annually Validators independent of management, but part of company Annually Owner of internal controls and ongoing monitoring SOX 404

Cost of SOX Implementation: 2005 2005 SOX Expenditure by US firms: $6 Billion Internal expenses: $2 Billion Hardware/Software: $2 Billion Consulting: $2 Billion Source: Gartner

Cost of SOX Implementation: Ongoing? A study from Foley & Lardner LLP shows that while the total cost of SOX compliance dipped in 2006, spending on so-called out-of-pocket costs rose by double-digit percentages. According to the Chicago-based law firm's study, public companies with more than $1 billion in annual revenue spent an average $10 million on costs such as board compensation and audit and legal fees in 2006. That's a 12% increase over spending in 2005. At public companies with revenue under $1 billion, the increase was 13%. External audit fees claimed the biggest chunk of money, accounting for more than 47% of the out-of-pocket spending on compliance by the smaller public companies. At companies with more than $1 billion in revenue, a whopping 60% of the money goes to external audit fees. "Some experts predicted that external audit fees would decrease after the initial implementation of Section 404 audits, as external auditors became more familiar with their clients' accounting controls and, therefore, more efficient in conducting their audits," said Thomas E. Hartman, a partner at Foley & Lardner and director of the report. "Our study results do not support this prediction. Indeed, external audit fees have been the only cost our study has shown to increase every year since the Sarbanes-Oxley Act was passed." Meanwhile, all the manpower and money that companies have invested internally on SOX compliance is beginning to pay off. According to the Foley study, most of that dip in total SOX spending in 2006 was due to efficiency improvements in internal financial reporting -- and thus a gain in productivity. IT departments shouldered a big part of the internal work done in preparation for SOX -- cleaning up and documenting processes. Can CIOs give themselves a pat on the back? "CIOs will be able to pat themselves on the back when they sit down and help the rest of the business automate the internal controls as much as they can, and help get down the external audit fees, which are out of control," said analyst French Caldwell, who covers compliance at consultancy Gartner Inc. in Stamford, Conn. "It's not over yet. Don't even stop to catch your breath." Caldwell said the Foley findings are consistent with other research. During the last three years, companies have seen about a 35% reduction in overall SOX compliance costs, almost all of which have come from savings on internal labor and on fees paid to consultants. But a reduction in internal labor costs or one-time consultants doesn't equate with "any great efficiencies," he said, precisely because the external auditing fees have hardly budged -- indeed they're "out of control." "That indicates to me that there is just as much to audit. That indicates to me that many companies haven't really rationalized the controls. They haven't automated a lot of the controls," Caldwell said. Nor have companies yet heeded the advice this spring from the Securities and Exchange Commission (SEC) to take a more risk-based approach to SOX compliance. Source: Linda Tucci, 16 Aug 2007, SearchCIO.com

So What’s a Corporation to Do? Continuous monitoring (CM) offers the only practical, cost-effective solution. Build a system that provides a perpetual inventory of governance Leverage IT to maximize automation and reduce staffing loads

Proposed CM Solution Pyramid Hardware/Data Integrity Component EMC: Centera ® , Proofspace encryption, record management automation Software Component Various vendor process automation products: Ex.: Documentum ® , Movaris OneClose ® , ACL CCM ® Co-sourcing component? Independent IT test services Planning Component SOX methodology: Assess, document, test, report Oversight Component “ Tone at the top”: Executive buy-in, “spirit” vs. “letter”

Sarbanes-Oxley’s Impact on the COSO Cube IT Components Section 302 Section 409 Section 404 Risk Assessment Control Environment IT Risk Management, IT Risk Assessments, Business Impact Analysis “ Tone at the top”, IT Governance, Regulatory Compliance Firewalls, Security, DRP, Business Continuity, SDLC, Change Control, Operations IT Policies, Standards & Procedures Email, Scorecards, Dashboards, Project Control, Help Desk Server Logs, Database Logs, Firewall Logs, Intrusion Detection, Incident Response, Awareness Training Monitoring Information & Communication Control Activities

CM Solution Requirements One Close® Organizational Consulting ACL CCM/ One Close ® Documentum ® One Close ® Technology (HW/SW) People (staff, mgmt.) Risk Assessment Control Environment Monitoring Information & Communication Control Activities Resources needed Tool or process needed (examples only):

Key Recommendation Validate methodology through execution on a pilot process (assess, document, and test) Remediate consistently and constantly Work with external auditor to ensure approach is satisfactory via a full trial on a key process before rollout

Internal Control Maturity Model Control structure is not defined. Control occurs incidentally. Control structure is not defined, but control processes may occur based on past success and management oversight. Control structure is documented, standardized and integrated into control processes for the organization. The control process is regularly assessed and tested. Detailed measures of the control process are collected and reported. Continuous process improvement is enabled by quantitative feedback from the control process. Initial Repeatable Defined Managed Optimizing Predictability, effectiveness and efficiency of an organization's internal controls improve as the organization moves through these five stages. Initial Repeatable Defined Managed Optimizing

COSO-Driven Methodology: Assess Process Outcomes Management support Internal champion Trained team Consensus on objectives Risk-ranked universe The plan Form team Perform risk assessment Confirm results Develop work plan Define overall SO requirements Identify and form team Partner with external audit firm Confirm audit universe Define risk weighting Conduct assessment Analyze assessment results Confirm risk rankings Map to knowledge base of mitigating practices Present findings to management Develop plan for documentation phase Review plan with external auditor, management Remediate Ongoing coordination between management, external auditor, and consultant ASSESS TEST REPORT DOCUMENT

COSO-Driven M e t h o d o l o g y : Document Process Outcomes ASSESS TEST REPORT Remediate Ongoing coordination between management, external auditor, and consultant COSO alignment Document control activities Improve controls Define monitoring process Define target maturity level by process Assess COSO maturity by process Identify where improvements are needed Define control objectives Determine tool approach Map assessment to objectives and identify gaps Develop plan to address gaps with control changes Assess and implement changes in controls Test new processes and train users Confirm the role of the internal audit department Assess current monitoring environment Implement monitoring process COSO maturity ranking Consensus on end state Improved controls environment Ongoing monitoring Documented controls DOCUMENT

COSO-Driven M e t h o d o l o g y : Test Process Outcomes Remediate Ongoing coordination between management, external auditor, and consultant Management control monitoring Independent monitoring Management reporting process Ongoing reporting Management controls monitoring Material weakness plan Ongoing report process Educate management on controls Develop framework for management monitoring Facilitate management monitoring of controls Identify weaknesses from management test Develop action plan for weaknesses Reiterate if necessary Implement process for ongoing quarterly reports Define process for development of IC report Partner with external auditor on report requirements Independent internal audit Testing Develop framework for independent monitoring Facilitate independent monitoring of controls ASSESS TEST REPORT DOCUMENT

COSO-Driven M e t h o d o l o g y : Report Process Outcomes Remediate Ongoing coordination between management, external auditor, and consultant Management report External audit External control testing External auditor assertion Management reports on role in controls Management reports on testing process Management delivers final controls report External audit commences External auditor tests controls per requirements External auditor reviews management report External auditor issues final report External auditor issues final assertion ASSESS TEST REPORT DOCUMENT Management report External audit report External assertion

Benefits/ROI ROIs are easily calculated, by the determination of FTE reduction due to PCAOB’s Standard II regarding the testing of automated controls once, versus reiterative testing necessary for manual controls. Secondary benefit, especially in the ability to store the results of continuous monitoring in an authenticated, digital format, should have a significant impact on future third-party litigation revolving around alleged misconduct by management, in proving the validity of the effectiveness of key control activities.

Illustrative Assessment Work Plan

Framework for Risk Assessment Identify What are the risks? Measure What is the relative degree of risk? (Determined by Severity and Likelihood .) Prioritize Which risks are most important?

Risk Assessment: The Big Picture Internal and external risks faced by all organizations. Requires linked and consistent management objectives. Identified/analyzed to manage and achieve objectives. A system to address organization impact of external and internal condition changes. IIA Definition - “… a systematic process for assessing and integrating professional judgments about probable adverse conditions and/or events. …organize and integrate professional judgments for development of the audit work schedule.”

Enterprise Risk Assessment Driven by enterprise strategies and overall goals. Risk rank audit universe, applying the same risk factors to all audit entities. Top-down focus begins at the enterprise level. Bottoms-up begins at the entity level. Approach dependent on management’s objectives and other initiatives in place.

Enterprise Risk Assessment Defined Enterprise Risk – Potential exposures which could significantly impact or impede an enterprise’s ability to succeed in accomplishing its overall financial and operational goals and objectives. Risks can be categorized as follows: Strategic – relating to high-level goals, aligned with and supporting the entity’s mission/vision. Operations – relating to effectiveness and efficiency of the entity’s operations, including performance and profitability goals. Reporting – relating to the effectiveness of the entity’s reporting. Compliance – relating to the entity’s compliance with applicable laws and regulations.

Ways To Look At Risk Quantitative Assign a value to each control risk times a probability of the threat of the risk Higher value/greater risk Qualitative High, medium, low or adequate/inadequate

Approaching Risk Assessment Solicit executive management’s enterprise strategies, goals, objectives and concerns. If applicable, obtain external auditor’s perspective of the company. Also consider insurers, outside counsel, other third-party service providers. Capture organization, products, processes, functions, locations, systems, support areas, etc. relevant to auditable entities. Develop a model using risk factors, weightings and scoring criteria. Objective is a risk-ranked audit universe.

An Enterprise Risk Assessment Tool Provide analyses regarding risk exposures at an audit universe (enterprise) level. No pre-defined database of standard questionnaires, risk factors and set risk weightings. Information compiled by experienced professionals. Information/analyses as good as the information compiled.

Types of Risk Factors Assets at risk Cash Inventory Intellectual property Operational Procurement Production Material Handling Sales Service Human Resources Planning Legal Environmental Systems Information quality Security Disaster planning Equipment/software Financial Data accuracy Available information Completeness of data A/R, A/P, Cash flow, etc.

Risk Weighting and Scoring Weigh risks based on customized criteria. Relative importance of individual risk factor. Risk factor impact on business units based on likelihood of occurrence and severity of impact. Facilitate with management and process owners. Risk weighting results reviewed by management and the process owners. Risk score is assessed for each risk factor. Scores summed for a total risk score. Supports risk ranked audit universe.

Risk-based Approach: Examples Business Processes Alignment Business Continuity Compliance Contracting Empowerment Environmental Fraud Health and Safety Illegal Activities Management Information Obsolescence/Shrinkage Product/Service Quality Relevance Unauthorized Use Technology Availability Access Functionality Integrity Usability Functional Risk Finance Collateral Counterparty Credit Currency Derivatives Interest Rate Liquidity Reinvestment Settlement Financial Reporting Financial Assessment Evaluation Financial Statement Falsification Regulatory Reporting Taxation Strategic Risk Capital Availability Competition Financial Markets Flexibility Industry Leadership Legal Regulatory Product Life Cycle Product Development Reputation Trademark Erosion Sovereign Strategic Assumptions Valuation Authority Bench Strength Budgeting & Planning Capacity Commodity Communication Cycle Time Efficiency Human Resources Organization Structures Performance Metrics Pricing Resource Allocation Supplier Technology Selection Technology Deployment Conversion Risk

Risk-based Approach: Process Company Strategies Executive Management Input Risk Factor Model Development Executive Management Input and Buy-in Extract Risk Factors from Strategies Identify & Define Risk Factors to be Used Define Related Scoring Criteria for Each Risk Factor Weight the Risk Factors Audit Universe Development Input Obtained from Many Sources Organizational Charts, Internal Management Reports, Company Directory, Annual Report, General Ledger, Location Listings, Major Projects or Contracts, Information Systems, etc. Cost Centers, Profit Centers, Investment Centers, Locations, Functions, Processes, etc. Risk Exposure Scoring Scoring Occurs from Interviews with Senior Management Responsible for the Auditable Entities One Person may be Responsible for Scoring Multiple Entities Many Persons may be Responsible for Scoring One Entity Audit Plan Development Compute Risk-Ranked Audit Universe from Completion of the ERA model Develop Audit Plan Based on Risk-Ranking and Available Resources Obtain Executive Management Approval Execute Audit Plan Reassess Risk Exposures

Risk-based Approach Re-cap Risk-based approach Defined model of enterprise risk factors Customized to fit our client’s needs Efficient direction of audit resources Supported by an electronic tool that provides for data analysis Provides sufficient information to build an audit plan Performed by experienced professionals Cost effective solution to improve enterprise risk management initiatives

Dwayne Jorgensen, CIA, CFE Consultant, Governance Spirit Consulting Services Dwayne Jorgensen, CIA, CFE, is a recognized expert in governance, risk and controls. Mr. Jorgensen created the Sarbanes-Oxley Services & IT Governance global practice for CTG, a 39-year old IT staffing solutions firm. He is respected for his ability to assess a clients’ current state of compliance with Sarbanes-Oxley (SOX) and then guide them in meeting their compliance goals, especially those related to Sections 302, 404, and 409 of the act. In addition, Mr. Jorgensen has developed a “continuous monitoring” solution for corporate governance and speaks on the role of IT in that endeavor. Mr. Jorgensen is an expert in COSO, risks and controls, specifically as these areas pertain to the impact of SOX on corporate governance. He has over 20 years’ experience in internal audit, system controls, practice development, capital acquisitions, and risk management. Before CTG, Mr. Jorgensen was North American Practice Director of internal audit services for Jefferson Wells International. He oversaw the growth and development of the firm’s internal audit service line in the United States and Canada post-Sarbanes-Oxley, especially in the areas of 301, 302, and 404 compliance. He also directed the business process outsourcing practice for the Atlanta office of Arthur Andersen, LLP, and was elected a principal of the firm. He was a senior manager for Coopers & Lybrand, LLP, and director of internal audit and secretary of the audit committee for a Flagler System, Inc. Mr. Jorgensen is a member of the Institute of Internal Auditors and the Association of Certified Fraud Examiners, and has a Bachelor of Arts degree in pre-law with a major in accounting and finance from the University of Illinois-Urbana.

Dwayne Jorgensen, CIA, CFE Consultant, Governance Spirit Consulting Services – Referrals “ I had the opportunity to work with Dwayne during an extremely critical period as our company attempted to address Sarbanes Oxley concerns. Dwayne and his team were simply the best of the best. I highly recommend Dwayne and would welcome the opportunity to work with him again.” April 1, 2008 Top qualities: Great Results, Expert, High Integrity Mike Pulaski - hired Dwayne as a Business Consultant in 2004, and hired Dwayne more than once “ Dwayne was directly responsible for developing Jefferson Wells approach to provision of Sarbanes Oxley services just after the act was passed by congress. He was on the leading edge of the service. His leadership was instrumental in subsequent success the company enjoyed.” January 7, 2008 Bob McDonald , Director Construction Services, Jefferson Wells International - worked indirectly for Dwayne at Jefferson Wells International “ Dwayne took a leading role in developing the regulatory compliance practice in the UK operation. I found Dwayne to be very commercially focused and felt his strengths were in developing a lasting relationship with the client.” January 8, 2008 Martyn Smith , Senior Consultant, CTG (UK) Ltd - worked with Dwayne at CTG “ Dwayne was the key provider in the delivery of an excellent Sarbanes-Oxley assessment audit of our business processes and provided specific and creative recommendations for implementation of corrective actions.” January 4, 2008 Top qualities: Personable, Good Value, On Time John Ponzo - hired Dwayne as a IT Consultant in 2004 “ I encountered few people in the three years I was selling SOX and GRC applications that truly understood the intertwined nature of a control environment and technology. Dwayne understood the pro's, the con's and the yet to be challenged status quo. Dwayne knew early that complex control issues could be tackled efficiently using technology and at a reduced overall cost. Simply put Dwayne "gets it"!” January 28, 2008 Brian Tietje , Senior Sales Consultant, Movaris - was with another company when working with Dwayne at CTG

Contact Information Dwayne E. Jorgensen, CIA, CFE Consultant Spirit Consulting Services 1851 Baltusrol Trail Duluth, GA 30097 Office: 678/957-0838 Mobile: 770/789-7581 E-mail: dej@spiritconsultingservices.com

Need For Corporate Governance

More Related Content

What's hot

Viewers also liked

Similar to Need For Corporate Governance

More from Dwayne Jorgensen

Recently uploaded

Need For Corporate Governance