SOX compliance is a complex and evolving process. No matter if a company used to issue audited financial statements in the past, it must build and maintain the capabilities to comply with the Sarbanes-Oxley Act to understand different factors (potential new costs, current risks of material misstatements, and awareness of internal changes) that may impact the efficacy of your program.

The SOX compliance program helps understand the strengths and weaknesses of an organization. There are few ways through which you can better balance the cost of your SOX compliance program with the risks of material misstatements in your financial statements.

How To Maintain SOX Compliance Program?

Let’s discuss some tips that will help you to maintain your SOX compliance program in the financial year 2020-21.

• Expect Additional Costs from PCAOB Inspections
• Start Early
• Monitor and Assess Key Staff Turnover
• Segregate Duties
• Understand IT Risks

We’ll walk through these tips one by one.

Expect Additional Costs from PCAOB Inspections

“According to the 2020 budget report for PCAOB (Public Company Accounting Oversight Board), the budget has increased over the years(i.e., 2018-2020).”

Based on this report, the board reaffirmed its strategic direction. The trickle-down effect uncovers the areas during the inspections of external audit firms and any significant deficiencies (identified in those inspections) help the PCAOB to meet its goals of greater financial reporting transparency and investors’ protection. But, inspections will continue to pressurize the work performed by (and costs companies pay) their audit firms.

Start Early

Execute a robust planning process at the beginning of the financial year and reduce the chances of errors, audit headaches, and avoidable costs. In the beginning, anticipate where the additional focus will be required in the coming year.

PCAOB revealed common challenges in its findings from recent inspections:

• Impromptu design, documentation, and testing of internal controls over financial reporting.
• Inadequate understanding of likely misstatement sources.
• Inaccurate or incomplete information and data used in estimates.
• Inappropriate accounting implementation for changes in business as well as new accounting standards.

It was observed that PCAOB included equity, revenue recognition, inventory, and liability accounting many times across its reports. The report also mentioned the following factors as deficient for small organizations:

• Controls for ensuring proper segregation of duties.
• Assessing the competence of financial reporting duties outsourced to a third party.

Monitor and Assess Key Staff Turnover

Whenever a person leaves an organization, several factors are considered - from ensuring the proper exit to figuring out how his role will be filled. If the person who is responsible for key internal control exits from the organization, it can add additional risk to the organization. So, assess the impact of the change quickly to make sure that his internal control duties are performed timely and in a way that addresses the related risk.

Segregate Duties

For protecting a company’s assets, duties must be segregated properly. This internal control is essential to protect the accuracy of the financial statements. When application controls are designed and monitored properly, it can help to reduce the workload. But, automation adds risks, such as proper access management and system administration, that require to be considered.

Another level to manage cost and risk effectively is delegation. Let's assume a portion of internal control tasks being delegated. Segregation challenges can be addressed by funneling detailed reviews through senior staff or management and result in a surprising efficiency.

Understand IT Risks

IT is a fast-evolving area in an organization that raises the probability of misstatements due to cyberattacks. The sole targets are not only big enterprises - hackers can target any organization (small or big) through different tactics such as social engineering and spoofing emails. Although such practices are not new, their sophistication has increased dramatically. It is found that there is a rise in successful efforts to defraud companies in different ways like misdirected payments to employees and vendors, demands to wire money to continue key services, and threats to company data.

Therefore, you must know the key to your company assets and take steps to ensure that they remain in control. Make sure all procedures and policies are in place and followed while using the keys to distribute company funds or assets. It is to be noted that if you have mistakenly sent money - that will never be recovered, and you have not recorded or disclosed accurately, it indicates a control deficiency and possibly worse.

Bottom Line

Companies continuously face upward pressure on the costs of SOX compliance. However, smart planning, sound decisions on control implementation, and a coordinated effort throughout the year can help keep SOX compliance costs in check. Therefore, you require experts who know how to navigate the complex water of financial statement risk management and compliance.

COVID-19 pandemic has already affected the global economy negatively. In this unprecedented situation, companies must realize the importance of executing and documenting internal control activities. Companies must assess whether the materiality thresholds and levels of precision have to be adjusted for adequately addressing changes to the business as well as the corresponding risk.

Due to COVID-19, companies will require to eliminate significant and unusual transactions controls. They will require to eliminate controls over the area where the pandemic becomes a triggering event as controls require additional attention to asset valuation. Businesses must continue as a going concern and compliance with debt covenants.

Talking about the impact of COVID-19 on the global economy, companies will require to reassess their accounting judgements and estimates, as a consequence, need to reassess their impact on management review controls. They will need to scrutinize the key assumptions and inputs and review the robust management documentation.

In addition, auditors - both internal and external, will expect management to assess potential coronavirus impacts on the control environment that includes management review and controls. Auditors will look at the controls’ operation during the uncertainty period. People with SOX compliance role must evaluate how the key assumptions in the management review control areas were changed/reviewed/approved for the financial year 2020.

Control Documentation

Let’s understand how to prepare the control documentation for an organization. Consider the following steps to prepare the control documentation for your organization.

1. Identification of Key Assumptions
2. Challenge Key Assumptions
3. Increase the Level of Evaluation
4. Consult with Specialists
5. Evaluate Any New Controls
6. Coordinate with External Audit

Now, let’s discuss each step one by one.

Identification of Key Assumptions

In this financial year 2020, many underlying assumptions will require to be revisited. Also, the population of key assumptions will require to be confirmed and potentially adjusted or expanded. Standard calculation inputs may require to be revisited and considered as key assumptions.

It is to be noted that every input should not be considered key and subject to the same assessment. Identification of key assumptions and identification of the amount of change in the assumption would impact the output by a considerable amount.

Challenge Key Assumptions 

After refreshing the sub-set of the key assumptions, the management must address those areas and accounts where key assumptions may be more difficult to compile and evaluate in uncertain times. Organizations are endeavoring to revise forecasts in a unique environment that is different for each organization. Thus, the judgements and estimates are more likely to be reassessed throughout the financial year 2020. Moreover, it will be important to document how companies evaluate contradictory evidence.

For instance, going concern is the management review control area, its key assumption and consideration are:

• Challenge revenue forecast inputs as well as any corresponding expense reduction programs, and 
• Consider debt refinancing and compliance waivers.

Increase the Level of Evaluation

The 2020 financial year will require a more detailed evaluation in comparison to the evaluation that was necessary during the last several years of strong economic prosperity. Now, step 0 or qualitative assessment may not be enough. So, you will need to take further analysis and evaluation steps. The Public Company Accounting Oversight Board (PCAOB) has revised AS2501 - audit standards on auditing accounting estimates (including fair value measurements) for fiscal years ending on or after December 15, 2020. So, management will also feel the follow-on effects of such additional requirements from the external audits.

Consult Specialists

With more detailed evaluations, the management will need to consult with specialists in new areas, i.e., areas in which external validation of assumptions and models were not required in the past. The PCAOB is also revising standards for specialist use. It is now more important for management to challenge and approve the work of specialists.

Evaluate Any New Controls

New controls (temporary or permanent) may require to be added with organizational changes including remote working and facility closure. Management must consider whether these controls meet the criteria of management review controls and require the necessary additional documentation.

Coordinate With External Audit

It is advised to communicate with the external auditor (early and frequently) on the impacts of the pandemic with all aspects of internal control over financial reporting. Management must review and obtain an external audit agreement with the updated execution and documentation of management review controls in this financial year.

In The End

When the adverse economic conditions persist for a long time, it is more likely that write-downs or adjustments occurred in Q1 will require to be revisited. But, if you have evaluated controls over these areas in the first half of the financial year 2020, it will help to ensure that quarterly financial statements are accurate and you can relieve some of the pressure on bandwidth in the latter half.

A corporate governance system is a set of legal, regulatory, and best practice elements. It was not only popular in India but around the world. The global community (investors and lenders) is less likely to add governance risks to the country and industry risks that are already inherent in their investment portfolio. The revised Clause 49 and the Listing Agreement are needed to be viewed in the backdrop of a significant increase in capital flows across the globe.

Corporate Governance

Good corporate governance can increase the value of shareholders. This has motivated legislators and regulators to tone up standard practices and laws. Stock exchanges observed that a separate index of companies with high governance ratings significantly outperformed the market index.

International credit agencies have also incorporated corporate governance variables into their credit rating methodology. However, the most interesting development is the weightage of corporate governance in the investment selection process by fund managers as opposed to the ownership management processes that have been the most relevant so far.

As the calibration gets fine-tune, the global banking systems could follow portfolio capital adequacy norms with risk weights for corporate governance. Therefore, governance might be an explicit consideration for companies issuing debt and influence the corporate cost of capital.

Business performance measures, such as well-hones internal systems, processes, and governance standards, are essential for companies to be competitive. Indeed, corporate governance is rapidly transforming into a business consideration.

More independent boards have become the order of the day. A significant number of independent or non-executive board of directors are required by almost all internal and international governance codes to address this issue. Independence is also gaining momentum in all parts of the world.

One cannot find fault with the need for independent professionals to make qualitative contributions to the board as it takes some time to create a reservoir of such independent directors. The independent directors can ask critical questions, bring in new perspectives to risk management and strategy, and evolve board meetings into brain-storming sessions that add value.

Increasing business complexity has made it impractical for the board to look at the company’s financial statement in detail. Thus, the role of the audit committee must be expanded, and they must be given tasks to understand such financial statements, discuss with internal and external auditors, and review the financial and accounting policies of the company periodically.

Committees can perform efficiently if their members are competent professionals having an understanding of finance. Proactive companies had already appointed audit committees (that are effective) even before the advent of Clause 49.

Clause 49

Clause 49 of the Listing Agreement is the only comprehensive set of requirements for corporate governance for listed companies in India. There are several pitfalls in Indian corporate governance. For instance, In India, the requirement of Clause 49 is completely inappropriate due to control over directors’ remuneration. In countries other than India, directors, and management receives sky-high remuneration and perks, irrespective of the company’s performance.

Remuneration of directors is hardly an issue in typical promoter-driven companies in India, so with Companies Act archaic limits on managerial remuneration and sitting fees are retained.

CEO/CFO Certification

Corporate governance requires vigilance that introduces the requirement for CEO/CFO certification. It can be viewed as a culmination of immaculate systems and business practices.

GrayCell Technologies has created an innovative web-based solution (i.e., CEO/CFO certification application) for helping Indian companies to implement Clause 49 compliance requirements. This application utilizes the .NET technology framework that helps to simplify the implementation process of CEO/CFO certification. It has already established processes to bring changes in the controls environment of several Indian companies such as Tata Chemicals Ltd. and Nestle India Ltd.

GrayCell Technologies is an award-winning digital solution provider company having more than 16 years of experience in delivering result-driven design, development & analytics solutions. It has proven experience in a broad range of business applications that use both open source and proprietary software technologies. GrayCell’s development team ensures to offer top-notch quality solutions at a competitive price within the specified timeline.

Conclusion

Issues in Clause 49 occurs in the method and techniques and not in the concept. Rather than copying methods that are not suitable for Indian corporations, a fresh approach is needed to bring a willing and enthusiastic application of corporate governance that will benefit all stakeholders in the long run.