In the past, a company with six quarters of profitability and $2 million in profits would be a good IPO candidate. Today, the high costs associated with Sarbanes-Oxley compliance sometimes estimated at as much as $2 million annually have contributed to a change in companies’ exit strategies from IPOs to acquisition. There is some evidence that venture capitalists are shying away from IPOs because SOX compliance costs make their short-term ROIs less attractive than they would have been 15 to 20 years ago.
There are ways companies can reduce their compliance costs. One of the best ways is to transfer their focus on manual accounting controls to automated controls. Doing so can enhance their SOX compliance, reduce the time and money they spend on achieving it, and increase their value to investors.
Smart Business spoke with Roy Maynard of Burr, Pilger & Mayer LLP to learn how those benefits can be achieved.
How can companies save time and money by changing their focus on controls?
One area is in the risk assessment phase. Remember, SOX is focused entirely on the financial statements. Companies are still relying on manual, rather than automated, controls. The automated controls within the accounting application can be controlled by the general computing controls, which ensure the continuous and proper operation of the program procedures and the integrity of the financial data. These controls cover direct access to the data and to the application. Companies that have this group of controls in place can be reasonably assured that their program procedures will operate continuously and that they will have data integrity. They can rely on computers, for example, to cross-match receivers to invoices, rather than doing it manually. Just a simple change like this can save a company time and money. More reliance on automated controls reduces the risk of financial misstatements and costs less to test and execute.
Are the costs of complying with SOX inhibiting companies from offering IPOs?
Yes. There is a change in companies’ exit strategies post-SOX. Whereas companies once offered IPOs as a liquidity event, now they are looking at being acquired. Fifteen or 20 years ago, venture capitalists investing in a company thought its liquidity event would come about as the result of an IPO. That has changed. Consider a company that does $80 million in business in a year and takes $2 million to $3 million to the bottom line. If that company had to pay out an additional $2 million annually of costs for SOX, it would be back to break-even. It would not be viable in the market. That is a realistic scenario in some venture capitalists’ minds. Based on the increased costs of SOX compliance, they see fewer opportunities for IPO liquidity events.
How can companies keep SOX compliance costs low?
One way is to be prudent and rigorous in monitoring the costs of SOX compliance. Don’t assume that compliance is going to cost $2 million or so a year. Treat SOX compliance like any other business process and strive to lower the cost each year. It can be lower. Just as in a manufacturing process, working with professional advisers can help companies find ways to reduce costs.
Another way is to take advantage of automation opportunities. For example, some companies don’t automate the collection of data that goes into compliance documentation. So, if auditors select a specific transaction, and the paperwork for it was misfiled or on some ones desk, the auditors may look at that as an error. They may then have to increase their sample size or do other procedures. That runs up compliance costs. If companies collect data more efficiently, hopefully electronically, and allow the auditors to select what they need from the population of documents, that reduces costs.
Where else are companies missing opportunities?
Another example is payroll processing, which is a material expense for most companies. Most companies outsource their payrolls to service providers that exercise a set of controls to assure the continuous operation of their programs and data integrity and execute manual controls to make sure all the transactions are processed and reported correctly. Often they provide a SAS 70 report, which is an audit report on the design and effectiveness of the service providers controls.
Perhaps a better way to look at controlling payroll would be to perform an actual-to-budget comparison monthly, do a roll forward of total payroll costs and rely on the service providers controls. These types of automated analytic controls can be very effective in this situation and reduce the need for detailed transactions controls once again reducing the cost of SOX compliance.
ROY MAYNARD is a consulting partner with Burr, Pilger & Mayer LLP. Reach him at (408) 961-6390 or firstname.lastname@example.org.