What kind of a SOX trainer are you?

This article is also available at http://trustenablement.com/local/Beyond_SOX_Article.pdf

What kind of a SOX trainer are you?

It depends on the type of clients you have and their overall approach to Trust management

Management consultants are a lot like personal fitness trainers.  Whereas the latter gets bodiesin shape, the former gets companieswell-tuned and ready for the next big game.  Take for instance the Sarbanes Oxley Act (SOX), a response to the now infamous Enron and other US corporate scandals; SOX poses both a significant challenge as well as a tremendous opportunity for Management Consultants in Canada and elsewhere to lead companies into better health and improved corporate governance.

While companies have been aware for a while now that SOX rules were looming on the horizon, 2005 marks the first year in which the CEOs and CFOs of all publicly companies listed on US stock exchanges will be required to provide assurance on their internal controls.  Many more Canadian companies are also affected both through multilateral agreements with the United States and new provincial legislation¹. That means management consultants are presently encountering clients who are at varying levels of compliance maturity. Whereas some companies may require only minor tweaking of existing compliance programs to meet SOX standards (e.g., 45 minutes in the gym twice a week), others require a more rigorous workout that entails education² and guidance to help them identify the gaps and determine their SOX requirements.³ Consequently, consultants must be prepared to quickly assess their clients' needs and provide them with the appropriate knowledge and tools to guide them through the training circuit.

A sample of client types for SOX compliance

As with fitness trainers' clients, the clients of management consultants can fall into one of several categories based upon level of "fitness"; in turn, consultants will experience varying degrees of challenge and will need to respond to each client type accordingly:

CLIENT #1

Mr. Unmotivated:Just like the less-than-zealous gym-goer, this type of client finds the process of SOX flat-out painful, and fails to see the overall importance it will bring to the health of his company.  He is unclear about what needs to be done and consequently may bury his head in the proverbial sand, avoiding rather than embracing certain change.

His Consultant: "I think many companies view SOX ... more as a nuisance that is costly to their business, where they don't have enough time, money or resources to do everything that this legislation requires.  Their primary focus is, as it should be, to keep improving the bottom line," says Toronto-based independent SOX compliance consultant Mary Oko, CA, CMC. "However, I believe they don't yet see the true value that SOX can bring to their organization in terms of improved internal controls and streamlined business processes, which will lead to reduced costs."

The Approach:Consultants canhelp reluctant clients to understand and manage the risks of non-compliance.  By gaining an understanding of the clients' business priorities and risk profile, consultants can define a phased and prioritized roadmap to compliance that clearly and credibly demonstrates management commitment.

CLIENT #2

Mr. Don't-want-to-be-a-flabby-guy-any-more:This client has a good idea of what needs to be done for SOX compliance; he sees it realistically in terms of how its rules affect all aspects of business, and strives to integrate the process beyond the accounting department.

His Consultant: In this case, everyone is more or less on board and the management consultant can readily step up to the plate and play a critical, integrative role in helping to coordinate compliance efforts between departments, such as information technology and human resources involved in enterprise resource planning systems (ERP) implementation projects.  Similarly, standard operating procedures, such as for authorization of pay raises and price changes require coordinated review and may necessitate business process re-design.  Employees also need to accept required changes to the way they contribute to their organization, as resistance can be disruptive and costly. 

The approach: Consultants can help to smooth such change initiativesby providing awareness training and stakeholder facilitation services; they can also arm themselves with best practices for building trust^{4, 5}, the key to successful change.

CLIENT #3

Mr. Total-performance: The performance-oriented visionary client understands the role of implementing SOX controls but sees it merely as one means, albeit an important one, of taking charge of the company's overall well-being.

His consultant: This emerging group is already well put-together and understands the relative role of SOX as a minimum requirement for building and maintaining confidence in their publicly traded securities.  They have undertaken projects with a broader mandate, bearing names such as "SOX & Beyond," to signal their understanding of the causal business issues that have precipitated the need for SOX legislation.  They realize that compliance alone is not sufficient to restore public confidence in capital markets and that internal controls do not necessarily make it any easier to rely on the validity⁶ of information.

Approach:  These clients know that the "rules of the game" have changed forever and they can no longer be successful conducting "business as usual".  Consultants need to demonstrate how corporate executives can explicitly codify their overriding commitment to stakeholder trust and confidence in business strategy and infrastructure mechanisms that support every critical business process - starting with corporate policies⁸.

Conclusion

SOX compliance rules are designed primarily to maintain reliability by ensuring consistent results under all circumstances and thereby protecting from a loss of trust - which essentially assumes that a required trust structure already exists.  They are often inadequate for determining the accuracy, comparability, relevance, understandability, and completeness of information and therefore do little to establish required levels of trust by investors. 

Although SOX does provide some mechanisms for establishing "fast trust" (for example, by requiring CEOs and CFOs to certify financial statements as the primary source of trust), many suggestions for restoring "high trust" remain unaddressed, such as participation of stakeholders, performance benchmarking, metrics tracking and reporting, and systems for financial transparency⁷. 

No business operates in a vacuum.  Business performance depends entirely on the ability of the corporation to successfully engage the cooperation of its key stakeholders.  The key to a healthy trust-based company lies in empowering stakeholders with tools that give them confidence to commit to transactions that support corporate business objectives.  Reducing stakeholder uncertainty accelerates the volume, velocity and value of every transaction, thereby reducing costs, supporting higher price-points, smoothing volatility and increasing profitability.  Trust is an essential pillar of the bottom line and a critical success factor.

Management consultants therefore have an opportunity and an obligation to guide clients through all levels of the process, including that of addressing stakeholder trust and confidence issues strategically, by taking an integrative approach to achieving specific trust objectives with both their external and internal stakeholders.  Such an approach helps executive management to commit to stakeholder trust and confidence and forms the foundation for an infrastructure⁹ that supports all critical business processes intended to engage key stakeholders in support of business objectives.

SOX is but one component in the big game of business.  However, it is one that holds tremendous opportunity to take your clients to a whole new level of heath. Convincing your more sceptical clients of its benefits is the first step to a total trust makeover.

Alex Todd is founder and president of Trust Enabling Strategies, a Toronto-based management-consulting firm that helps organizations to improve bottom-line performance by developing processes designed to reduce stakeholder uncertainty.  He can be reached at AlexTodd@TrustEnablement.com

References:

1. Refer to Baker & McKenzie's Canadian Investor Confidence Rules in Review at http://www.bakernet.com/NR/rdonlyres/ee6d2mo45kxbawftvzfitw3jrpsbgmpuahvxj6j3iigalg6ebsmlaulbqpt5ncapxc25zs7qg3sizlrjugoybieqp6f/CCH+Cdn+Investor+Confidence+Rules+Feb04v1.pdf
2. Excellent introductory resources are available on the Internet, such as at http://www.sarbanes-oxley.com.
3. For Canadian compliance survey results and a proposed 15 step compliance process refer to "Microsoft Office Solutions for Compliance Management" presentation by Habaneros at http://www.habaneros.com/NR/rdonlyres/3D4F8937-2053-429B-AD19-2E3DE6DD92F2/0/MicrosoftOfficeSolutionsforCompliance.ppt
4. McKinsey and Company recently presented research results on the factors that affect organizational change (see presentation at http://slftoronto.org/content/view/59/).
5. Taking Charge of Change by Shari Caudron at http://www.businessfinancemag.com/magazine/archives/article.html?articleID=4931
6. See article "Seek Validity, Not Reliability" by Roger L. Martin, Dean of Rotman School of Management at the University of Toronto, in The HBR List: Breakthrough Ideas for 2005 at http://harvardbusinessonline.hbsp.harvard.edu/email/pdfs/R0502Af2_Listserv.pdf
7. For an example of a Trust Enablement^TM approach to assessing business critical success factors and building confidence in capital markets see  http://trustenablement.com/local/Assessment_of_Critical_Success_Factor.pdf.
8. An example of one approach to defining Corporate Trust Enabling^TM Policies at http://trustenablement.com/Policy_Recommendations.htm.
9. For a discussion on infrastructure requirements see "A POX ON BOTH YOUR HOUSES: ENRON, SARBANES-OXLEY AND THE DEBATE CONCERNING THE RELATIVE EFFICACY OF MANDATORY VERSUS ENABLING RULES" by Jonathan R. Macey at http://law.wustl.edu/WULQ/81-2/Macey.pdf.