Getting a Lock on Sarbanes-Oxley Compliance

The single-vendor approach works for Master Lock, the world's largest padlock maker, which had a head start because of its ISO-compliant status.

When it comes to the Sarbanes-Oxley act of 2002, the key to compliance at Master Lock Co. is integrated systems. Master Lock, the worlds largest padlock maker, sells more than 50 million padlocks a year. The Milwaukee-based company is a subsidiary of Fortune Brands Inc., in Lincolnshire, Ill.

While many companies struggle with the documentation requirements of the act, Master Lock had a head start because of the companys ISO-compliant status. The International Standards Organization requires that corporations document quality management and process control systems to gain certification at manufacturing sites.

"ISO is as big or an even bigger documentation effort than Sarbanes-Oxley, so we had a lot of Sarbanes-Oxley taken care of from a documentation standpoint," said Richard Kolaczewski, vice president of finance and IS at Master Lock. "We rolled off of our ISO projects in 2001 and 2002 and went straight into Sarbanes-Oxley, which worked out perfectly for us."

In the mid-1990s, Master Lock decided to tear out its antiquated supply chain systems and launch a massive project to expand its supply chain globally while standardizing its front- and back-end systems on Oracle Corp.s E-Business Suite 11i. Master Lock is currently running Oracles Entry, Receivables, Inventory, General Ledger, Manufacturing, Procurement and Fixed Assets applications.

"In the past, we had to work with 80 different interfaces on any given day just to close the books," Kolaczewski said. "To have taken that environment and tried to comply with Sarbanes-Oxley would have meant hiring a significant number of people, which would have been difficult in todays cost-conscious environment."

Using Oracle applications, Master Lock was able to consolidate these interfaces along with more than 100 databases. The company now works with a single interface across North America when accessing data.

Status Report

Company: Master Lock Co., a subsidiary of Fortune Brands Inc.
Location: Milwaukee
Sarbanes-Oxley stage: Preparing for a public audit for Section 404 compliance
Compliance timeline: As part of a publicly traded corporation with a market capitalization of $75 million or more, Master Lock will need to comply with Section 404 by June 15
Currently focused on: Internally auditing documentation processes by the end of February
Tools: Oracle Corp.s E-Business Suite manufacturing applications; Microsoft Corp.s Excel and Access

Source: eWEEK reporting

With the integrated system, Kolaczewski said he no longer needs to worry about documenting all his databases or whether the numbers flowing from one database to another are correct.

The move to Oracle made things easier for Master Lock once Sarbanes-Oxley was passed by allowing data to be tracked more efficiently. Last year, as part of its Sarbanes-Oxley compliance strategy, the company added Oracles Manufacturing and Inventory modules. Master Lock plans to deploy Oracles Planning System this spring.

Kolaczewski said Oracle-generated reports ensure that people sign off on documents when necessary.

In the past, Master Lock had no way to attach journal entries and e-mail messages to documents. Now, it can attach an electronic document to a journal entry within Oracle applications. This will not only enable Master Lock to comply with Sarbanes-Oxley, it will also save time by allowing Kolaczewski and others to present documentation electronically during auditing. In the past, individuals had to be tracked down to answer questions from auditors.

"In the past, we were using file folders with a bunch of handwritten notes," Kolaczewski said. "Now, its pretty much point and click because all the documentation can be traced. Putting Oracle in allowed us to take care of a lot of issues that we knew wed face with Sarbanes-Oxley compliance later down the line."

To further ensure compliance, Master Lock also completed all its 2004 planning and budgets using its Oracle systems, a move Kolaczewski said would help prevent surprises at years end.

The company is now going through each requirement of Sarbanes-Oxley to ensure that everything is in order. Master Lock is working against a self-imposed deadline to comply with Sarbanes-Oxley by the end of this month. The company will then go through an external audit.

Kolaczewski said he is confident about his companys Sarbanes-Oxley compliance efforts, but he is not resting on his laurels. Master Lock will deploy Oracles Tutor application later this year to enable robust documentation within the Oracle applications themselves.

While Kolaczewski is confident that Master Lock has the formal procedures and policies in place, the company will continue to leverage the tools available in Oracle applications for compliance.

"The biggest compliance efforts are behind us," Kolaczewski said. "I looked at our Sarbanes-Oxley checklist the other day, and Id say were 99 percent there."

/zimages/3/28571.gifCheck out eWEEK.coms Enterprise Applications Center at for the latest news, reviews, analysis and opinion about productivity and business solutions.