Sarbanes-Oxley Act Compliance

Even small private corporations must comply with certain regulations
By Tom Nutile, Principal TN Communications Group The federal Sarbanes Oxley Act was established in 2002 in the wake of the corporate financial scandals at Enron and other large companies. The SOX act requires companies to set up standardized financial reporting protocols, checks and balances. Top management also must certify the integrity and accuracy of the financial statements.

Here are some policies and procedures the act requires of every corporation:

1. A whistle-blower policy that also spells out anti-retaliation rules
2. An audit committee
3. A charter for the audit committee that spells out committee member roles and responsibilities
4. A document retention and destruction policy outlining how and how long documents are kept

 

Obtain a summary of SOX requirements

If you're a corporation, you need to know the details of Sarbanes-Oxley and you must bring yourself into compliance. Several Web sites, including the federal government's Securities and Exchange Commission, list the requirements
Try: Check out these sites for a summary of what you must do to comply: SWLearning, SoxLaw.com, the SEC SoxAct page

Get help from your audit firm

The company that audits your business can advise you on how to comply and how to keep proper records that comply with Sarbanes-Oxley regulations.
Try: The American Institute of Certified Public Accountants lists ways your CPA firm can help you get on the right side of the regulations.

Set up a whistle-blower policy

Sarbanes-Oxley requires you to establish a whistleblower policy that protects the whistleblower from retaliation. Common policies include sections on confidentiality and handling of reported violations, usually to a member of the audit committee.
Try: Find a sample whistler-blower policy that you can tailor to your company from the National Council of Nonprofit Associations.

Follow document retention requirements

One of the key components of SOX is retention of records for a certain period of time. The best way to do this is set up a record retention policy that complies with the act and generally accepted accounting principles.
Try: Download a sample record retention policy from the American Bar Association, make sure you're in compliance with SOX and other state and federal regulations on record retention by checking a table from this QuickBooks site, and find a list of questions to ask when setting up a retention policy from the Web site of law firm Holme Roberts & Owen.

Use special software programs

From helping you set up internal controls to testing and managing databases, software can help you comply with the Sarbanes-Oxley Act.
Try: You can get SOX software from Expensewatch.com and Quask.

Set up an audit committee

You must set up an audit committee and designate responsibilities to certain members. SOX mandates that certain committee members have specific financial certifications.
Try: This CPA Journal guide tells you how to set up an audit committee that meets requirements, as does this Securities & Exchange Commission guide. The Institute of Internal Auditors provides a sample audit committee charter.

Publicly traded companies have additional SOX responsibilities

If you're a publicly traded company, senior management must certify the integrity of your financial statements. You are also subject to audits of your internal controls and limitations on personal loans to executive officers or directors.
Try: For a list of the additional responsibilities of a publicly traded company, click on the University of West Georgia guide and this CPEOnline primer.

• Make sure your IT system is robust enough to produce timely, accurate and detailed financial reports to comply with Sarbanes-Oxley.
• Your compliance should include ways to make sure emails concerning financial matters are saved for a specified period of time and accessible from archives if needed.
• Consider an email policy that underscores to employees the fact that any and all emails on financial matters could be retrieved by regulators.
• Consider setting up regular internal audits to make sure you are in compliance of Sarbanes-Oxley.
• Many companies establish policies and practices and then fail on implementation. Be as rigorous in your implementation as you are in creating your policies.