Compliance for year two and beyond

Deloitte Consulting has its finger on the pulse of publicly traded companies and finds considerable interest in turning compliance efforts into opportunities to increase business value. Not only is such an effort doable, it can also deliver returns that exceed initial costs.

Deloitte recently polled more than 700 participants in a Web seminar and found considerable support for transitioning compliance to a value-enhancing activity. "Seventy percent said their organizations had identified business benefits as a result of their Sarbanes-Oxley compliance effort," reports Lee Dittmar, principal with Deloitte and co-leader of Deloitte's Sarbanes-Oxley practice. "Additionally, 75% said their companies identified opportunities to enhance information quality."

Deloitte's stance is that compliance management efforts, particularly Sarbanes-Oxley (SOX), are an opportunity for organizations "to improve the processes and systems for turning data into information," says Dittmar. "Compliance with Sarbanes-Oxley should eventually be looked upon as a byproduct of doing things the right way-effective and efficient processes, performed by qualified, ethical people, enabled by the right technology."

Last fall Deloitte introduced its Sustained Compliance Solution Framework, part of an integrated offer to help organizations move beyond SOX's first-year requirements to build a sustainable compliance plan.

Dittmar says organizations must look to the second year of compliance efforts. "In the first year, we went through the blocking and tackling and put a foundation in place to get through the first-year requirements," he says. "Now, we move into the next phase of the journey, making the program more efficient and effective. We want to simplify, streamline and standardize where appropriate."

Deloitte's objective is to reduce complexity. Unnecessary complexity can result in fragmented data sources, inconsistent data definitions, redundant processes across business units, manual processes and non-standardized, non-integrated technologies. Correcting these situations increases the quality of the intelligence flowing through the enterprise by lending transparency, timeliness, accuracy and reliability to business-critical information.

The enterprise data warehouse can boost these efforts, Dittmar says. "As more companies look at their ability to produce quality information in a timely, accurate, reliable way, a very important part of the architecture is the database," he says. "There are a lot of issues, challenges and complexities in the processes and systems of many companies. Some don't have relevant data in common databases. Many haven't rationalized their IT architectures or forced common processes where appropriate. Even after implementing new enterprise systems, many haven't turned off old legacy applications."

Complex patchworks of systems and data make it difficult "to quickly pull data into analytical or forecasting applications," Dittmar says. "They could benefit from the power of a common enterprise database so they can get information on both a business unit and enterprise-level perspective. Companies need to improve their ability to get the information they need, have it in the right place at the right time and be able to turn it into insight to run the business better."

Such insights are critical to aiding sustainable compliance efforts. "An integrated performance dashboard can bring control information, financial information and operational information into a common view," says Dittmar. "It will provide more insight into what's happening in your business and help you identify problems earlier."

A sustainable compliance program doesn't happen overnight. Deloitte's compliance solution is designed to be flexible and scalable so clients can develop their best plan. Deloitte's framework accelerates companies' planning efforts, and helps prioritize process, organizational and technology work over the realistic time horizon. T

A broad look

Deloitte takes a holistic approach to compliance, believing that an effective, ongoing compliance solution should include: a measurable, effective and efficient internal control toolkit that supports assessment, monitoring and reporting processes the integration of financial reporting and internal control processes sufficient technology to enable compliance with Sarbanes-Oxley and related regulations support for financial and internal control reporting processes designated process owners and participants, with clearly articulated roles and responsibilities and assigned accountability education and training to reinforce the control environment the flexibility to evolve as organizations, environments and regulations change