In the past, a company with six quarters of profitability and $2 million in
profits would be a good IPO candidate. Today, the high costs associated
with Sarbanes-Oxley compliance —
sometimes estimated at as much as $2
million annually — have contributed to a
change in companies’ exit strategies
from IPOs to acquisition. There is some
evidence that venture capitalists are shying away from IPOs because SOX compliance costs make their short-term
ROIs less attractive than they would
have been 15 to 20 years ago.
There are ways companies can reduce
their compliance costs. One of the best
ways is to transfer their focus on manual accounting controls to automated
controls. Doing so can enhance their
SOX compliance, reduce the time and
money they spend on achieving it, and
increase their value to investors.
Smart Business spoke with Roy
Maynard of Burr, Pilger & Mayer LLP to
learn how those benefits can be achieved.
How can companies save time and money
by changing their focus on controls?
One area is in the risk assessment
phase. Remember, SOX is focused
entirely on the financial statements.
Companies are still relying on manual,
rather than automated, controls. The
automated controls within the accounting application can be controlled by the
general computing controls, which
ensure the continuous and proper operation of the program procedures and the
integrity of the financial data. These controls cover direct access to the data and
to the application. Companies that have
this group of controls in place can be
reasonably assured that their program
procedures will operate continuously
and that they will have data integrity.
They can rely on computers, for example, to cross-match receivers to invoices,
rather than doing it manually. Just a simple change like this can save a company
time and money. More reliance on automated controls reduces the risk of financial misstatements and costs less to test
and execute.
Are the costs of complying with SOX inhibiting companies from offering IPOs?
Yes. There is a change in companies’
exit strategies post-SOX. Whereas companies once offered IPOs as a liquidity
event, now they are looking at being
acquired. Fifteen or 20 years ago, venture capitalists investing in a company
thought its liquidity event would come
about as the result of an IPO. That has
changed. Consider a company that does
$80 million in business in a year and
takes $2 million to $3 million to the bottom line. If that company had to pay out
an additional $2 million annually of costs
for SOX, it would be back to break-even.
It would not be viable in the market.
That is a realistic scenario in some venture capitalists’ minds. Based on the
increased costs of SOX compliance, they
see fewer opportunities for IPO liquidity
events.
How can companies keep SOX compliance
costs low?
One way is to be prudent and rigorous
in monitoring the costs of SOX compliance. Don’t assume that compliance is
going to cost $2 million or so a year.
Treat SOX compliance like any other
business process and strive to lower the
cost each year. It can be lower. Just as in
a manufacturing process, working with
professional advisers can help companies find ways to reduce costs.
Another way is to take advantage of
automation opportunities. For example,
some companies don’t automate the collection of data that goes into compliance documentation. So, if auditors
select a specific transaction, and the
paperwork for it was misfiled or on
some ones desk, the auditors may look
at that as an error. They may then have
to increase their sample size or do other
procedures. That runs up compliance
costs. If companies collect data more
efficiently, hopefully electronically, and
allow the auditors to select what they
need from the population of documents,
that reduces costs.
Where else are companies missing opportunities?
Another example is payroll processing,
which is a material expense for most
companies. Most companies outsource
their payrolls to service providers that
exercise a set of controls to assure the
continuous operation of their programs
and data integrity and execute manual
controls to make sure all the transactions are processed and reported correctly. Often they provide a SAS 70
report, which is an audit report on the
design and effectiveness of the service
providers controls.
Perhaps a better way to look at controlling payroll would be to perform an
actual-to-budget comparison monthly,
do a roll forward of total payroll costs
and rely on the service providers controls. These types of automated analytic
controls can be very effective in this situation and reduce the need for detailed
transactions controls — once again
reducing the cost of SOX compliance.
ROY MAYNARD is a consulting partner with Burr, Pilger & Mayer LLP. Reach him at (408) 961-6390 or [email protected].
