Bradley/Lambert Inc.

The date for attestation of the Internal Control System is almost here. Ñ The attorneys and accountants have done their work. Ñ New processes and procedures are in place. Ñ

There is one more critical job: successfully training employees so that there is common knowledge and skills around these new processes.

Ñ Common interpretation of the processes and a new ethical climate are essential to making it all work on a day to day basis.

Ñ Is this last step required?

Ñ Absolutely it is, because the SEC requirement is for tests of the new system to be effective. Ñ There is no credit for just having them in place.

Designing effective controls is only the first step. Ñ Everyone who plays a role in implementing internal controls needs to have a common interpretation of the requirements. Ñ This is where the difficulties start ¦ interpretations! Ñ Virtually all employees are asked to certify that their departments have implemented effective internal controls; they do so in good faith and based on their interpretation of the control requirements. Ñ Their boss then assumes that these employees have the same interpretation of the control requirements that the boss has.

Have these conversations ever happened in your company?

Production Manager : Ñ ?Jane, we really need to get ABC Components paid this week. Ñ We need them to ship more components to us and they say they must be paid for the last shipment. Ñ I just can?t wait for all of the paperwork in our system. Ñ Can you authorize payment?²

Division Manager : Ñ ?I know how slow things are. Ñ Let?s get them paid now and we?ll work out the back-up documents with Accounting later.²

Branch Office Manager : Ñ ?I just received a letter from a Big Customer confirming that they plan to buy 2,000 new units. Ñ Since this is March 31, I want to be sure we book the sale this quarter. Ñ Let?s ship the order today and notify Accounting immediately.²

Shipping Manager : Ñ ?It probably won?t go out until tomorrow.²

Branch Office Manager : Ñ ?Just put the paperwork through to ship it today. Ñ We can?t always control whether or not the shipping company picks up on any given day.²

What procedures should be followed in each of these situations? Ñ What is the importance of following the right procedures? Ñ When can an exception be made to a procedure? Ñ In the first situation, the manager rationalized that this was a special case and he or she would fix the problem later by submitting appropriate documentation. The manager, in the second case, rationalized that a letter of intent was as good as an order and that the exact timing of the shipment was not important as long as the paperwork was submitted.

These situations illustrate the problem that companies face when they implement control requirements in accordance with the requirements of SOX and the SEC. Ñ When employees face a situation where they must take action to meet a performance measure, their interpretation of a procedure or control may be different than what was intended. Ñ If employees do not know the reason for the procedure, the importance of the controls and the correct interpretation of the process, the company is exposed to significant risk.

Every month in their SEC filings, companies disclose material weaknesses or significant deficiencies in internal controls. ÑÑÑ The disclosures often use phrases like: ?irregularities², or ?insufficient supervision of personnel², or ?lack of training related to procedures². ÑÑ Although fraud is always a possibility, what typically creates problems is a misinterpretation of what is acceptable and what is not acceptable, what is expected and what is prohibited.

What does this mean for the CEO and CFO of publicly traded companies that will be required to certify their company?s internal controls starting June 15, 2004? Ñ It means they will be relying on everyone in the company to correctly interpret and implement procedures and internal controls. Ñ Significant attention has been paid to enhancing internal controls. Ñ New checks and balances, new process, new requirements, new systems will be rolled out in most companies. Ñ How these are implemented will make the difference between an effective system of internal controls and one with many problems. Ñ Now it is time to look at how these controls will be institutionalized and ensure accurate interpretation. Ñ

Would all key employees answer these questions consistently?

How do I avoid conflict of interest?
What is my role in protecting company assets?
What policies and procedures should I follow in my job?
What internal control requirements are parts of my job?
What is my level of authority and the authority of those around you?
What behaviors are expected, or acceptable, and what is unacceptable?

Most, if not all, employees would be able to answer at least some of the above questions. Ñ The key issue is whether or not they would answer them as expected or would there be a variety of different answers.

Written policies and procedures are not enough. Two employees can read the same document and have very different interpretations. They may also have very different views on how important a procedure is to the company. ÑÑ Training can provide a cost effective way to ensure employees have a common interpretation of the control requirements. Ñ

An effective internal controls training program must be targeted to the needs of specific groups. Ñ There is little value received from training the receiving personnel on how to do account reconciliation. ÑÑ The unique need for information on control requirements within each group, such as finance, accounting, purchasing, operations and support staff, must be identified. ÑÑ In some cases, people may only need limited training to stress the importance, requirements and boundaries of the process as well as where to go for clarification. Ñ This may be the situation for employees responsible for receiving products and materials. Ñ In other cases, such as accounts payable, there may be more control requirements that necessitate detailed training. Ñ

Adequate training also reduces risk by providing opportunities for employees to clarify their roles and responsibilities. Ñ Controls are often thought of as an accounting issue. Ñ The operations personnel may see it as something outside of their role. Responsibilities are clarified through effective training.

Training also provides for discussion so that employees express their interpretations and get their questions answered, rather than being allowed to make assumptions about what is expected. Ñ Misinterpretations can easily be avoided if employees had an opportunity to get answers. Ñ In the absence of clear information people are often very good at filling in the blanks. Ñ

Reduce the risk and start the learning process using training conducted in classrooms, interactive distance learning or synchronous web based trainin. Ñ These provide critical information, opportunities for questions and practice using the information. Ñ The learning process must be supported by just-in-time training such as on-line job aids, resources for quick answers to questions and coaching from immediate supervisors and subject area experts.

Employees may misinterpret procedures. Ñ Therefore, management has a challenge. Ñ CEOs and CFOs must be confident when they certify the accuracy of the financials and effectiveness of internal controls for their company. ÑÑÑ How can companies minimize the risk of misinterpretation and be assured that employees are knowledgeable and skilled regarding control requirements and procedures? Ñ

The answer is an integrated training effort that targets skills and knowledge for the job function, uses a variety of training methods and provides opportunities for all employees to discuss issues and ask questions.

Œ ?The Missing Link in Implementing Effective Internal Controls², ÑÑ http://www.bradleylambert.com/html/CW_article.pdf

Œ ?Is Your Ethics Program Adding Value², http://www.bradleylambert.com/html/news0503.htm

Œ ?Who Speaks Out About Ethics², Donaldson, Carmichael and more: http://www.bradleylambert.com/html/quotes.pdf

Œ ²Internal Controls Justification², It's not a cost/benefit analysis. It's risk aversion: http://www.bradleylambert.com/html/Internal_Control_Justification.pdf

To learn more about Bradley Lambert Inc. please visit us at www.bradleylambert.com

Tell us what you think. Ñ Send feedback.

Thanks for reading the Bradley Lambert Articles.

6151 W. Century Blvd., Suite 1110, Los Angeles, CA Ñ 90045

310-670-1400, fax 310-568-0681

Unsubscribe / Subscribe