?

Sarbanes Oxley Act (SOx) Consultancy

Overview

SOx has created a whole new world of risks and mandatory requirements for Top Management of public companies listed on the Securities and Exchange Commission (SEC) in the US. SOx also applies to subsidiaries of US companies outside the US.

Compliance administration can be complex and costly - stretching your already stretched resources even more.

The risks of non-compliance can be colossal for the CEO and CFO who are responsible for certifying the accuracy of financial data.

SOx was passed in response to a number of devastating accounting scandals, to ensure accurate financial reporting for public companies. It requires regulated companies to:

  • maintain internal controls that ensure accurate financial reporting;
  • identify material weaknesses and significant deficiencies.

SOx primarily covers the areas of:

  • corporate governance;
  • financial reporting;
  • executive conduct;
  • internal controls.

Section 404,deals with internal controls, inthis section the executive management is obliged to:

  • document internal controls;
  • assess the effectiveness of internal controls;
  • prepare a report on internal controls.

Service Offering

BCRM recommends the use of: COSO, ISO 27001, ITIL and CobIT.

These are four compatible frameworks, operating at different levels of detail and scope, that provide a set of controls and governance for IT:

  • COSO defines organization wide controls;
  • CobIT satisfies and extends COSO controls relating to IT;
  • ITIL can satisfy and extend CobIT controls relating to IT Service Management (Problem Management, Change Control, Release Control, etc.);
  • ISO 27001 provides information security controls to meet and extend CobIT Security.

When combined with BCRM's workflow and governance product (WFD) it can be used to aid the CFO and CEO obtain certification that internal controls have been implemented and are used effectively.

When combined with the BCRM recommended Identity Management process, to can provide complete traceability, transparency and personal accountability of all actions undertaken within your organisation.

Approach

We approach each project in the same manner:

  • definition of the scope of the project;
  • define and agree the relevant sections of SOx (and other legislation and regulation) that is applicable;
  • understand your business;
  • undertake a detailed gap analysis;
  • undertake a risk assessment;
  • present findings in form of a Gap Analysis report;
  • agree remedial work to be performed and delivery format;
  • produce remedial work in association with your employees;
  • implement awareness training;
  • ad hoc advice as required;

Benefits

The benefits of using a BCRM for SOx compliance is that they are able to:

  • create an organisational structure to ensure that roles and responsibilities for SOx compliance are established;
  • define and implement relevant documented procedures to meet the SOx requirements;
  • design processes and procedures specific to your business;
  • develop and delivering relevant training for all your employees to meet their SOx obligations;
  • develop innovative solutions to address your compliance issues;
  • ensure that processes and procedures for SOx compliance are documented and tested;
  • ensure that there is an ongoing compliance and monitoring mechanism in place.
  • identify and objectively assess your risks;
  • identify risk and evaluate risks to your organisation;
  • manage and treat significant risks to reduce them to an acceptable level in line with risk appetite;
  • protect the CEO and CFO;
  • provide employees with regulatory and governance experience;
  • provide governance, risk and compliance (GRC) experts;
  • provide information security and assurance experts;
  • provide pragmatic and relevant, as well as innovative, solutions to solve your SOx issues;
  • provide traceability, transparency and personal accountability for all actions if combining WFD and BCRM's identity management solution;
  • taking some of the burden off your overstretched Compliance Department;
  • validate the adequacy of IT controls to meet Section 404;

Next Steps

  • BCRM has a number of other service offering, these are listed here;
  • BCRM is committed to providing a consistently high value service to our Clients;
  • Sian Watson and David Lilburn Watson, who remain personally 'hands-on' throughout the process, manage this process.
  • to understand how the BCRM suite of offerings can be used to transform your business, please contact us
  • we look forward to discussing your specific requirements, at your convenience;
  • whatever other type of consultancy you require, we can possibly offer a free Health Check.