Case Studies

Case Study 7 – Sarbanes Oxley Implementation

Industry: Oil and Gas Services (Asia Pacific and Middle East)

Company: Medium sized company listed on NYSE.

Objective: To project manage SOX implementation at three locations, identify control deficiencies and remediate where required.

Results:
Due to rapid growth in the Asia Pacific region, the client operations in this region had only recently come into scope for SOX due to reaching the materiality levels. As a result, a team was quickly assembled towards the last quarter of the year to assist with documenting material controls and to undertake initial testing prior to year end, using pre existing documentation and risk assessments.

As a result of our effort we quickly determined that existing documentation was incomplete and rapidly developed the required flowcharts and obtained process owner sign off on all required processes.

Testing was undertaken which identified a number of key deficiencies surrounding cash controls and accruals processes. As a result we also undertook detailed projects to investigate the exposure from the deficiencies, and assisted with remediating the deficiencies through the training of key personnel, recommending improvements in internal controls including segregation of duties, and writing the system specifications for key exception reports to assist management in reconciling application interfaces.

The client was extremely pleased to pass the year end external audit attestation without any surprises for two years in a row, to a large extent due to the team effort and the effective management of all stakeholders in the process, including the external auditors.

Lessons learnt:
Having a qualified and experienced team on site to assist with external auditor management is highly effective, to ensure that the materiality of weaknesses and deficiencies is properly discussed and appropriately reported, if at all required.

Identifying deficiencies internally and rapidly developing action plans and responsibilities, with support from the Internal Controls team, is crucial to inspire confidence and manage external auditors.

A top down approach to internal controls documentation and testing is imperative to avoid focusing on irrelevant controls. The average time taken for a control test was 4 hours and substantial time could have been saved if the initial planning of scope had been adequately performed.

BACK to Case Studies