Sarbanes-Oxley: A foreign perspective

By Greg Naylor, CPA

Everyone knows by now that Sarbanes-Oxley has a far-reaching impact on domestic companies, but what about the implications for U.S. international companies with foreign subsidiaries?

I experienced the impact first-hand while working as an independent contractor on a Sarbanes-Oxley project for a large international company.

The company has plants around the world, including several in the United States, Europe, Australia and Brazil. The initial plan was that work outside the United States would be minimal as the company used SAP throughout the company and across divisions — except for Brazil, which used an Oracle legacy system.

As we began to document processes and controls, it became clear that while centralized systems and processes were in place, a number of differences existed in the global processes from plant to plant. It also was clear that there was a substantial amount of work responsibility for Sarbanes-Oxley compliance in Brazil, which utilized the assistance of the local staff of an international accounting firm.

The Brazil location consisted of a plant not unlike the other plants around the world, but with a separate sales office. It was considered a separate public company in Brazil, although it was majority-owned by the U.S. parent company. Brazil was unique since it was on an in-house Oracle system running in its own data center.

Decisions, decisions

I quickly learned that a number of important decisions had to be made on how to approach this project. First and foremost was deciding what language to use to document and assess controls. By the time I became involved, officials were already behind in their documentation and had started preparing it in Portuguese, the native language. I immediately got to know the local financial controller, who (fortunately for me) spoke excellent English and was very dedicated and helpful. I was also impressed that officials already had a good understanding of Sarbanes-Oxley requirements from their local auditors (PricewaterhouseCoopers and Ernst & Young), internal company correspondence and professional literature. It was a pleasant surprise, since it saved a lot of time explaining the requirements.

The bad news was that we would have to translate the process documentation, risk matrix, worksheets and other tools used to document the processes, controls and evaluation into English for U.S. management and U.S. auditors to review. We put this process into motion and I began to receive the documentation in a language I could read ... almost! As anyone who has worked with others from around the world knows, translation does not always work perfectly. Some words and phrases are different. Thus, a second decision was made to not waste time changing the wording and making it grammatically correct as it we wrote it. As long as the reader could understand the process, controls and assessment, it would suffice. Grammar corrections, we decided, would have to be kept to a minimum if we were going to have any chance of completing the project on time. In addition, we knew that revisions would be made throughout the various phases of the project, documentation, walkthrough and testing, remediation and reviews.

Once we got the first round of documentation in what we hoped would be "good shape," we scheduled the local auditors to assist us with walkthrough and testing. In scheduling the local auditors, the true worldwide impact of Sarbanes-Oxley became apparent. The local auditing firms were well-versed in Sarbanes-Oxley and were in great demand from U.S. companies trying to comply. Scheduling was tight for auditors experienced in Sarbanes-Oxley. Once committed, we were informed it would be hard to change or get additional resources.

I was a bit skeptical of just how complete the documentation would be due to the lack of onsite resources and familiarity with the staff to assist with the documentation. In addition, I wondered how much information was lost in communications and translations. So the decision was made for me to travel to Brazil to get the project started on the right track with the auditors and local management and to assess the resources required to complete the project.

Up to speed

Upon arriving in the sales office in San Paulo, I met the staff from the accounting firm assisting us with walkthroughs and testing. They informed me that, as I suspected, the documentation, while a good attempt, needed some improvement. They were also very knowledgeable about Sarbanes-Oxley, although they seemed perplexed about the extent of the law and the requirements due to one company's problems. Their work was excellent and the hospitality, including translating for me, was greatly appreciated.

After a long day at the office, we flew out of a local airport (in the middle of the city) for a three-hour flight up the coast to Bahia, a small city where the plant was located.

The next day I met the controller's staff and the rest of the local auditors. I was again impressed with the level of knowledge of Sarbanes-Oxley and the fact that almost all of the auditors had specific Sarbanes-Oxley training and worked on Sarbanes-Oxley projects. We were able to hit the ground running, so to speak.

A quick assessment of the project through discussion with the auditors and controller revealed the project was going to be much more extensive than we anticipated in the United States and would require a significant number of additional resources, including information technology. As most companies have found, Sarbanes-Oxley is more complex and resource-intensive than initially felt, and the Brazil plant was no exception.

Throughout the project, which lasted nine months, I was impressed with the knowledge, hard work and dedication of the local employees and auditing staff. To my surprise, I found out that many of them had visited the United States and lived there for a period of time, either as students or on a work-exchange program, and had a high degree of knowledge about U.S. business. They were always willing to listen and provide advice and information, translating into English fluently.

Overall, the project was a success as the control environment was significantly improved and met the requirements of Sarbanes-Oxley.

While it is a U.S. law, Sarbanes-Oxley has implications around the world. Based on my experience, auditors worldwide are well aware of the requirements and qualified to work on Section 404 compliance.

Greg Naylor, CPA, is an independent consultant specializing in internal auditing and work related to the Sarbanes-Oxley Act.

Contact this Author: < Gregory Naylor > gnaylorcpa@gmail.com

This content has not yet been Rated.

To Rate content, please Login.