Print


Real-Time Internal Reporting Lessens Sarbanes Burden

By Jim Arnold

The Sarbanes-Oxley Act is a complex, far-reaching piece of legislation that can make certifying internal controls of the end-to-end payment process a demanding financial requirement.

One way to avoid potholes along this road is to use real-time transaction reporting—not reporting that comes days, weeks or months after a transaction is completed.

For large organizations, external spend consumes 50 to 60 cents per revenue dollar. External spend is a complex cross-functional component of the end-to-end payment process that involves the business unit making the purchase, the receiving department, the purchasing staff, accounts payable and multiple contact points within the supplier’s organization. With numerous handoffs in the process, a volume of operating locations, and thousands of employees involved, the end-to-end payment process presents significant financial risks if you don’t use real-time transaction reporting.

To anyone who has inadvertently disbursed money to a vendor and been unable to recover those funds, it becomes clear that the most cost-effective option is to prevent payment errors.

So the question becomes, how can a company move its internal reporting system from where it is today to a real-time model of reporting? One approach is to buy a software package that enhances existing technologies. There are many companies offering such products, but they can require a costly, time-consuming process. Another approach is to hire an outsourcing firm to complete the work, but again this can be an expensive solution.

Debbie Carlini, president and chief executive officer of a Pennsylvania-based company that delivers accounting software to mid-sized firms, says these solutions will not necessarily work for every company.

“If you’re running a $9 billion organization, there’s not going to be one place, or one building, that is filled with lots of people where you can have one financial solution,” Carlini said.

“There are a lot of disparate systems. Different companies have tried to address these disparate systems with different software solutions, but there is no one blanket program or package that will address the needs of every company. In the end you still have to have information to define internal controls; technology solutions can only do so much,” Carlini added.

To help avoid these complications, it’s important to think outside the box and take a different approach to the new requirements—one that won’t cost thousands of dollars to implement. One way of accomplishing this is to create a process flowchart to capture the various functional departments that participate in the end-to-end process.

Through tracking the departments, well-intended steps that over time have ceased to be effective can be identified. In committing the process to a flowchart, a company will need to address the process differences relative to purchase orders and signature authorization, and determine whether or not it is buying goods versus services. It’s also important to be alert to specific steps that are part of the theoretical process but are routinely bypassed or circumvented.

Once the end-to-end process is documented, the company will need to exercise a high level of skepticism to determine its potential problems. Observers agree that when validating internal controls, the logical first step is to document the control processes in place by highlighting significant risks and ensuring that these risks are properly mitigated.

This approach can help diminish the following major risks of the end-to-end payment process:

Bypass Procurement

The purchases of needed goods and services run the risk of completely circumventing the procurement function. Since procurement staff members are the experts in acquiring and negotiating the purchase of goods and services, how much money is lost by not engaging the procurement staff’s expertise in a disciplined acquisition process?

Contract/PO Creation

In creating the contract or purchase order, there are risks associated with engaging qualified suppliers, including the misalignment of interests between vendor and supplier, unenforceable contract structures, noncompetitive contracts, and the miscommunication of the relevant terms to those entrusted with enforcing the agreement. What is the financial cost associated with control weaknesses in the structuring or communication of contract terms?

Invoice Settlement

In the payment of a submitted invoice, errors may occur related to pricing, payment terms, sales tax, freight, duplicate payments, missed rebates, delayed updates to pricing catalogs and excesses of proper approval guidelines. How much profit is forgone due to vendors billing a company incorrectly, or process errors resulting in overpayments?

Once the financial risks and exposures are identified, there are three questions that should be answered to implement cost-effective internal controls.

First, the company must determine what procedures and controls have been implemented thus far to serve as a safety net when these risks inevitably materialize. Next, the company must conclude whether the controls implemented are preventive or reactive in nature. And finally, the company needs to decide what metrics it can track that will provide timely feedback on the effectiveness of those controls.

Sarbanes-Oxley places the burden on finance to document processes, highlight risks and monitor compliance with management’s intentions. For the end-to-end payment process, the critical tools to monitor compliance include cost metrics, productivity measures, control metrics regarding error ratios and overpayments, cash flow indicators and customer service metrics. With these in hand on a timely basis, any company can confidently live up to the spirit and letter of the law regarding Sarbanes-Oxley.

Jim Arnold is the president and founder of APEX Analytix, a professional services and software provider in the recovery audit and contract compliance space. Based in Greensboro, N.C., APEX Analytix is the recipient of the 2000 Verizon Supplier of Excellence Award and the 2002 Blue Chip Business Award; has been named to Deloitte & Touche’s North Carolina Fast 50 list for 2003 and the Triad Fast 50 list for 2001-2003; and was recognized as an Inc. 500 company in 1999. Arnold can be reached at jarnold@apexanalytix.com.