I fell in love with a client’s CEO a couple of weeks ago.
Platonically, that is. He’s an immensely successful entrepreneur, and we were discussing the value of his instincts for the business. “I don’t believe in instinct,” he told me. “I believe in evidence.”
Which brings up the recurring subject of Sarbanes-Oxley, why so many implementations spiral into out-of-control fiascoes, and what you can do to avoid that fate if you’re on the hot seat for bringing your company into SOX compliance.
At the KJR Conference last March, Jeff Sakamoto, then-CFO of Cyanotech Corporation, and Danielle Stariha, Director of Internal Audit for Gander Mountain Company shared their thoughts on the subject. Since they both managed to bring their companies into compliance on time and within budget, their thinking was well worth hearing.
I’m not going to try to summarize everything they said. They provided too much valuable content to easily summarize in a column or two, and much of what they had to say is similar to what’s been published elsewhere on the subject. Here are a few points you might not have encountered before, that will help you through your own efforts to become and stay SOX compliant:
- It’s basically a good idea — having clean books and effective controls. What SOX requires of publicly held companies are practices they should already have in place. If you start your SOX program with that philosophy you’ll make much more progress much more smoothly than if you start with the attitude that it’s something you’re doing for the Feds.
- It isn’t a good implementation of a good idea. Regrettably, like so many good ideas voted into place by our elected representatives, the good ideas were turned into a furball of documentation requirements. With SOX, if it isn’t documented it isn’t happening. Live with it.
- It’s a project. Scratch that — it’s a program, which is to say it has multiple threads of effort (initiatives) each of which consists of multiple projects, each of which must be managed well, just like any other project. It’s banal, it’s obvious, it isn’t worth saying … except that it must be, because one reason many SOX efforts go bad is a failure of basic project management.
- Master the subject. Your audit partner or some other SOX consulting experts will do a lot of the heavy lifting for you. That makes it an outsource, and like any other outsource, if you don’t know what’s going on you deserve whatever happens next. Another name for Sarbanes-Oxley is the Full Employment for Auditors Act. That doesn’t mean you have to be the one providing them with full employment.
- Your CEO’s attitude tells the story. If your CEO is like our client, preferring evidence to instinct, you have a chance. The starting point for SOX compliance is a CEO who uses the accounting system as a tool to help understand What’s Really Going On Out There.
We have Sarbanes-Oxley because too many CEOs consider their company’s shares of stock to be a product, and their financial reports to be a marketing tool for that product. Marketing is about persuasion — about spotlighting the most favorable facts, de-emphasizing the least favorable facts, and describing those that are open to interpretation from their most favorable angle.
The other reason for Sarbanes-Oxley is that many CEOs make it known throughout the enterprise that Bad News Isn’t Welcome Here. Never mind shareholders and the Wall Street Analysts shareholders listen to. Their desire to hear what they want to hear instead of what they need to hear is overpowering. They trust their gut, believe in their instincts, and if the facts say otherwise then you’d better adjust the facts to match their reality.
The question is what to do if you work for a CEO like that (and here I’m going beyond what Jeff and Danielle presented: Neither described their CEOs this way).
Being responsible for SOX compliance doesn’t empower you to fire the CEO, much as you might want to. Your choices … your choices if you want to be effective, at least … are limited to one: persuasion.
Start with the first tool of the effective persuader — empathy. Say, “I don’t like it either, but we have to do it the SOX way whether we like it or not, and SOX doesn’t have a lot of wiggle room. We might as well be as efficient about it as we can.” And if you don’t feel any empathy, that’s okay — you don’t have to.