Tom Martin, audit operations manager for Boise Cascade Corp., in Boise, Idaho, said his company has yet to determine how much it will spend on Sarbanes-Oxley compliance, but estimates it will include 20,000 auditor-hours this year, after recording 17,000 auditor-hours on Sarbanes-Oxley compliance last year. "We should be in compliance by the end of the year," Martin said. "Then well have to do it all again next year.""We have to have a description of our controls and evaluate our controls on an ongoing basis and be sure theyre in place and work," Martin said. "We needed something that could be accessible throughout the U.S. and the world. And we knew we needed a Web-based system, something that was very easy to use, since folks would only be doing it once a year." To Martin, Sarbanes-Oxley compliance is a five-phase project: planning; scoping, which is determining whats material to the company and needs to be documented; looking for information gaps; and implementation, evaluation and monitoring. Boise Cascade is now in the implementation, evaluation and monitoring phase and expects to be audit-ready by Sept. 30, Martin said. The company is doing a pilot project at its distribution centers, then will roll out Certainty to its other business units. "The product has enabled us to look at our controls environment in one package," Martin said. "We knew our controls were similar, but not the same, so we look for opportunities to standardize the process." Forming a central repository of documented controls for multiple business units is also the task at hand at Volt Information Sciences Inc. The New York-based company needs uniform, complete documenting of controls, business processes and risks, according to its chief financial officer and senior vice president, James Groberg. "The basic task may not be that difficult, but its extraordinarily difficult if you have many business units," said Groberg. "We need to be able to get at [the controls] quickly in a format the business units themselves can understand. We want an audit trail." Volt is using OpenPages Inc.s Sarbanes-Oxley Express product to build its controls repository. Groberg agreed that the process was expensive but described it as a "wake-up call," one that his company could benefit from in the long run. "[Section] 404 [compliance] is extremely difficult and very expensive, but in the long run, its a benefit for the management of the company," Groberg said. "Well be more certain that we have the internal controls in place that we need to have so well avoid the costs of finding errors." Having the right financial controls in place is nothing new at Volt and most other companies, Groberg said. "Weve always had these controls in place," he said. "Its a question of organizing them properly so that we have a better monitoring overview from the management standpoint and can prove to the public that we have the controls in place that can prevent a material misstatement." Next page: Compliance More Than Just a New Documentation System
Boise Cascade began an implementation of Movaris Inc.s Certainty product late last year to build a repository of accounting controls that share the same framework across the companys multiple divisions.