Wednesday, July 25, 2012

Rationalizing SOX from the ground up

Rationalizing SOX from the ground up

We are coming up on the 10 year anniversary of Sarbanes-Oxley (enacted July 29, 2002).  Most companies have gone through at least one major rationalization effort to reduce the number of controls and understand the true cost of compliance.  However, there are important rationalization lessons that have been learned during the past 10 years; namely, that rationalization isn’t a onetime event, that it takes involvement from all stakeholders, and that you company has to be diligent in measuring the progress you are making around SOX.

Rationalization is an ongoing effort

Rationalizing your controls isn’t a one-time event.  For global companies with ongoing changes, it’s an ongoing, all-the-time proposition.  Businesses change and growth in one market may be balanced with a retraction in another market.  Annually, you should be revisiting your scoping based on what is material. This will guide you in which markets need more attention due to growth and which markets need less attention due to contraction.  For those markets that are getting smaller, it may be an opportunity to rely on more entity level controls and do less detailed testing of process controls.  For markets that are growing, use this as a time to revisit documentation and the control framework.  It could be that controls that worked for a $10 million segment no longer meet your control objectives if the segment is now $100 million. 

It takes a nation

As you look at your control framework, use this as a time to include all stakeholders.  Invite your external auditors to the table to gain consensus that the key controls you are identifying are the same key controls they are looking at.  If Internal Audit provides testing services, include those parties as they will be able to provide a ground eye view of opportunity areas.  Representatives from Information Technology should be at the table as they can provide insight into controls that can automated and alignment to ongoing and planned IT initiatives.  Of course, the control owners need to drive the discussion as they have ultimate accountability for the control environment. 

You can only manage what you measure

Understanding your true cost of compliance is a fundamental aspect of rationalizing your control environment.  Are you measuring how long it takes to scope your certification testing?  Are you measuring how long it takes to test each control?  With this data, along with data points around control types (manual vs automated, detective vs preventative, controls by cycle), you can start to build a picture of the true cost of compliance.  Further, this picture will help you develop a return on investment for spend when it comes to projects that automate existing manual controls. While it may be challenging to ask your staff to log hours testing each control, this data is critical to building the right picture to sell the business case for change. 

Moving Forward

What will your SOX efforts look like 10 years from today?  I hope your organization is much more efficient and lean, while providing even more insight around risk than it is today.  And with the realization that SOX is evolving through ongoing rationalization, continuous engagement of all stakeholders, and diligent measurement, I know that your organization is well on its way. 

Wednesday, February 1, 2012

Exit Planning

Several large banks have recently announced that they were either going to sell or exit businesses or geographies.  RBS announced earlier in January that they planned to exit their Cash Equities business.  It’s being reported that Bank of America has told US regulators that they may exit some parts of the US market.  The news is not only limited to the financial services sector. Esprit Holdings, a clothing retailer, plans to close all North American stores after failing to find a buyer. 

While there are many reasons for exiting a business, a thoughtful strategy for executing the transition will not only increase the chance of success, it will also increase the value of the business being sold. 

The benefits of proper exit planning include
·        Control of how and when the exit of the business is conducted
·        Dignity for stakeholders who are negatively affected by the exit
·        Maximizing the value of the business
·        Shorter due diligence and transition period
·        Have multiple transition options to choose from

Develop A Comprehensive Exit Plan

A comprehensive exit plan includes elements that address questions such as
·        Exit Objectives – What does the management team hope to achieve by exiting the business?
·        Exit Options – What is the preferred option?
·        Valuation of the business – What is a fair offer?
·        Stakeholder Analysis – Who should be involved in the exit planning?
·        Determination of value drivers and cash flows – How can you maximize the business value in the short term to negotiate better offers?
·        Implementation Plan – What are the steps to sell or dispose of the business?

Set Your Exit Objectives

The first step is to set the exit objectives.  What does the management team want to achieve?  The highest cash offer?  The quickest sale?  The objectives will depend on the reasons why the business is being exited in the first place.  An exit objective because the parent is bleeding cash is very different than an exit objective for a profitable entity which simply no longer meets the strategic objectives of the parent.

Determine Your Exit Options

Next, engage a team of experts that can help you develop a set of exit options.  Depending on the size of your firm, resources may be internal or you may need to hire external consultants.  Typically, these would include a CPA, attorney, and appraiser.  This might be one individual or a group of people.

Conduct a detail analysis of your exit options along with a rank ordering of the options.  These may include the sale of the business to a 3rd party, an inside transfer of the business to a management team, or liquidation.  As you refine these options, you may have to conduct the next steps (valuation and stakeholder analysis) and come back to finalize the preferred option in order to have a complete picture. 

Determine a value for your business

Use your team of experts to come up with a reasonable value of your business.  While there are a variety of approaches to utilize, the three main approaches are

·        Income approach – Using your current income stream and a discount rate to determine the present value of that income stream.  Discount rates used are typically related to the cost of capital (such as weighted average cost of capital or the use of a model such as the capital asset pricing model). 

·        Asset approach – This determines the value of your business based on the assets on the balance sheet (inventory as well as plant, property, and equipment).  The assets are adjusted to fair market value which means a valuation may need to be done on each asset class.

·        Market approach – This determines the value of the business based on other recent similar transactions (i.e. businesses that have been recently sold) that have occurred.  This approach typically uses public information (such as stock price, earnings of public companies, sales, and revenues to find comparable companies).

As part of determining the value of your business, it is also important to consider what the optimal deal structure would look like.  Is a cash sale preferred?  What a stock transfer be acceptable?  Determining these now will provide guidance as to which type of buyer would be best for the business.

Conduct Stakeholder Analysis

As part of looking at what your business is worth, you should also conduct a stakeholder analysis.  Be mindful not only of economic stakeholders, but also social stakeholders as well. To name just a few groups:

·        Staff
·        Customers
·        Shareholders
·        Suppliers
·        Business Partners
·        Local Interest Groups
·        NGOs
·        Media
·        Trade Unions
·        Regulatory Parties

Consider mapping the stakeholders against a matrix of ‘Interest of Stakeholders’ and ‘Influence/Power of Stakeholders’ to determine how to appropriately work with and communicate to each of the stakeholder groups.


Exit planning can be a trying time for everyone involved and needs to be carefully managed.  With proper planning, this can be achieved.