If you answer, “Yes” to any of these questions, then Sarbanes-Oxley is highly likely to affect your business. If you answered, “No” to every question, you may find that ignorance of Sarbanes-Oxley is not likely to harm you—by itself. Even then there are sound business management reasons why you should understand SOA, but more about those later.

While Sarbanes-Oxley by its terms applies mostly to publicly-held companies regulated by the SEC, the requirements of the Act and related rules have significant implications for virtually every business. Let's take a quick look at what Sarbanes-Oxley mandates for those companies it impacts directly, and then we'll discuss the implications for other companies.

While SOA has 11 major parts, much of the Act pertains to the establishment of oversight functions, detailed regulations of auditing firms, and definition of the penalties for violations. The primary operational areas directly affected for those publicly-held companies to which SOA explicitly applies are these:

• In each annual report, management must clearly state their responsibility for establishing and maintaining adequate internal control structure and procedures for financial reporting; and management must assess the effectiveness of those internal controls.
• External auditors also must report on the effectiveness of these internal controls.
• The CEO and CFO must sign off on all annual and quarterly reports.
• Senior executives must sign a code of ethics.
• Off-balance sheet transactions must be fully disclosed.
• Companies must disclose material changes in their financial condition in real time—without delay.
• Companies may not make personal loans to executives.
• Directors, officers and other major shareholders must report any purchases, sales, or new issuances of stock immediately.
• Employers must give employees 30-day advance notice of any pension fund blackout period. (This applies to ALL businesses.)
• Changes are mandated for the audit process and for relations with external auditors.
• Severe penalties are established for retaliation against any kind of corporate whistleblower and for destruction of records. (This applies to ALL businesses.)

So how does any of this affect companies other than the large publicly-held businesses regulated by the SEC? This is happening in several ways:

• First, certain provisions of Sarbanes Oxley ARE directly applicable to all businesses whether public or private. These include giving notice on pension fund blackouts, retaliation against whistleblowers, and destruction of records.
• Additionally, a number of states are considering imposing Sarbanes-style regulations on local companies not otherwise subject to Sarbanes-Oxley. Some are already moving in that direction.
• Companies must become compliant with SOA before they can launch an IPO if they plan to do so.
• Even companies that plan to be acquired by other companies must think about SOA. Privately-held companies that fail to meet SOA requirements are less attractive targets for acquisition because of the additional expense and effort needed to bring them into compliance. Even if they ultimately sell to another privately-held business, non-compliance with SOA may reduce the overall number of suitors thus reducing the selling price.
• Publicly-held companies and governmental entities may impose contractual obligations for their suppliers to conform to certain of the Sarbanes-Oxley mandates to ease their own compliance.
• Venture capital firms may impose SOA compliance on companies in which they invest.
• Banks and other financial institutions may enforce similar requirements on those to whom they lend money through loan covenants.
• Trade creditors may determine that customers who don't comply with SOA are less credit-worthy than those who do.
• Insurance companies may apply SOA-type standards before issuing D&O coverage, and they may deny coverage in cases of restatement of financial results.
• Labor unions sensitive to charges of executive rip-offs of corporate assets may insist on compliance with SOA requirements as a part of the collective bargaining process.

Sarbanes-Oxley manifests itself most clearly in financial reporting, and its implications for financial management are profound indeed. But SOA compliance requires a strong linkage among process transparency, business controls, and financial reporting that transcends all business processes.

Organizations must structure their business processes and systems to meet the demands of Sarbanes-Oxley. While SOA doesn't require the use of business technology, the relationship between SOA compliance, process design, and business technology is crucial.

SOA is an opportunity to become a more process-based organization that, by design, empowers people by giving them more access to more information across the enterprise. And properly designed processes are, by definition, compliant with SOA.

To comply with SOA, many, perhaps most, organizations must make changes in their business processes — in many cases extensive changes. To make those changes without making those processes much more strategically effective at the same time is short-sighted and foolish. Organizations instead can use the requirement to comply with SOA as an opportunity to accelerate their business process improvements and strategic evolution.

Business executives must take full advantage of these tools not only to reduce the stress of Sarbanes-Oxley, but more importantly, to ensure that their businesses are both as ethical and as profitable as possible.

Copyright 2003, eCommerce Strategies, Inc.
This article may not be modified without the written permission of the author.

Jack Shaw helps businesses increase revenues, cut costs, improve service, and maximize the productivity of their people. An internationally recognized authority on using technology to improve business processes in ways that enable winning business strategies, Jack has spoken to thousands in over 20 countries.

A graduate of Yale with an MBA from Kellogg, and an expert with 30 years' experience in the design and implementation of advanced business management systems, Jack has written such best-selling business books as, Surviving the Digital Jungle and Doing Business in the Information Age. His forthcoming book is entitled, The Autonomic Enterprise™: The Complete Guide to Integrating Business Strategy, Processes, and Technology. His website is www.e-com.com.