|
Tuesday, 8th October 2024 |
Issuers need to use Sarb-Ox deadline extension wisely |
Back |
The SEC has recently announced an extension in the deadline for compliance with Sarbanes-Oxley for US listed Foreign Private Issuers (FPIs). But if Irish FPIs are to navigate the pitfalls in terms of time, effort, and euro that their US counterparts have endured, they will need to use the extension wisely. Dealing with resource issues early will be the key to achieving success and avoiding some of the potential issues, writes Paul Regnard. |
The US Securities & Exchange Commission (SEC) has recently announced an extension in the deadline for US listed Foreign Private Issuers (FPIs). Although much anticipated, the delay has nevertheless given FPIs the time they need to learn from their US counterparts, whose previous SEC S404 deadline extensions did little to ease the burdens involved in achieving first year compliance. If FPIs are to navigate the pitfalls in terms of time, effort, and euro that their US counterparts have endured, they will need to use the extension wisely. Dealing with resource issues early will be the key to achieving success and avoiding some of the potential issues.
| Paul Regnard has responsibility for providing S404 technical support for Ernst & Young's Financial Services Risk Advisory Group in Dublin. Paul is currently on secondment to E&Y's Global Knowledge T |
While it is clear that all Irish-based FPIs are pushing ahead with their S404 projects, aware that the extra time will be needed for remediation, it could be argued that they still have some catching up to do. An initial survey(1) of US-listed FPIs conducted shortly before the extension was announced, revealed that 40 per cent of respondents anticipated a close finish i.e. one to two months ahead of the original deadline date. Given the experiences amongst US accelerated filers of close finishes, and those who failed to complete the work, this would appear to be an optimistic assessment for at least a portion of the surveyed companies.
The survey also reported that some significant sized FPIs (>$5billion revenues) were still estimating they would get away with spending < 10,000 hours on the project, whereas accelerated filers > $5billion in revenues had all expected to spend > 10,000 hours. Total effort required will be a factor of a multitude of variables including the skills mix of resources being applied.
Although, in general FPIs are progressing at a similar rate to that which US accelerated filers achieved in the financial services area. US filers enjoyed a faster rate of progress due to previous industry regulations having similar requirements to S404. However, there is a significant risk that FPIs are still underestimating the time and resources required given the complicating factors faced by FPIs listed above.
So what planning should the FPIs be doing?
The survey reveals certain project team skill sets, namely financial controls, business processes, project management and IT audit as being crucial for project success. Getting the quality and mix of such resources right is a major difficulty.
It is clearly essential to have a detailed project plan, along with a budget for resources required. For 29 per cent of the FPIs in the survey no budget had been prepared. Those US filers who had established and allocated a S404 budget were better able to respond to implementation resource challenges.
The experience of US filers has also shown that as the project develops, the focus shifts from project development to meeting deadlines and obtaining relevant resources. The project team has the options of using dedicated project resources in the form of internal resources or outside consultants, or group internal audit to fulfil these needs.
The need for dedicated project resources
Internal resources: In Ireland, the S404 projects are competing with other compliance projects like IFRS, Basel II or the Directors’ Compliance requirements arising from the Companies (Auditing and Accounting) Act 2003 for internal resources. There may also be other business change initiatives or business as usual activities e.g. year-ends or external audits, to distract the internal resources from the project. A degree of training and/or retraining might need to be factored into the use of internal skills. Also, where internal resources have been used to produce the documentation, they might be hindered in terms of independence for use in testing the associated key controls.
External resources: For US filers, IT and Taxation were the two areas which required the most control corrections in the final quarter. Nearly all of the FPIs surveyed are using some degree of external assistance in these areas. Whilst some US accelerated filers lacked comprehensive and consistent availability of key skill sets, those that planned and anticipated these requirements were able to avoid or reduce last minute challenges in retaining external assistance. The recent extension will allow FPIs to plan for, obtain and apply external resources to update and or implement IT, taxation or other specialist resources requirements prior to initial compliance.
Group internal audit: Internal audit is being used to a greater or lesser extent as a ‘reluctant’ resource by most FPIs, providing a variety of functions including documenting, evaluating controls and test design, evaluation and remediation. They are also being used to lend objectivity in the testing area once documentation has been completed. The Survey revealed a planned increased reliance on internal audit in the second year of compliance once processes have been bedded down. This would also allow for retraining where audit functions have been operationally focused, rather than financially focused.
To ensure that the regular tasks of internal audit do not suffer, the project plan might call for a significant injection of resources into the function. Although ultimately the strategic direction of internal audit is a separate issue, good project governance requires that any planned reliance on internal audit be included in group strategic plans and driven in part by the project plan and budget.
Year two and beyond
It is estimated that the ongoing resource requirements for S404 compliance will be between 50 per cent and 75 per cent of year one resources (2), thus there is a need to consider the future resource requirements whilst planning for the current needs. Therefore the project plan and specifically the budget are crucial tools to balancing the changing resource needs both in the initial year of compliance and in subsequent years.
References:
1: Section 404 Post Implementation – What you should be thinking about today, Ernst and Young 2005
2: Emerging Trends in Internal controls – US listed Foreign Private Issuers Initial Survey, Ernst and Young 2005
Available at http://www.ey.com |
Paul Regnard has responsibility for providing S404 technical support for Ernst & Young's Financial Services Risk Advisory Group in Dublin. Paul is currently on secondment to E&Y's Global Knowledge Team in the US, helping to collate the learnings from S404 year 1 compliance from US Banks.
|
Article appeared in the May 2005 issue.
|
|
|