• Illustration: Compliance Site and Control Environment

The Microsoft Office Solution Accelerator for Sarbanes-Oxley helps companies document their internal financial controls, as required of U.S. public companies by the 2002 Sarbanes-Oxley Act. Released in Mar. 2004, the Accelerator enables companies to build intranet sites to collaborate on financial control documentation as they work toward compliance deadlines in late 2004 and mid-2005. Solutions built on the Accelerator will particularly benefit companies already using Microsoft products in their compliance efforts, but complete solutions will often require additional expertise and software.

Microsoft believes that regulatory compliance in general will be a significant driver of new business for itself and partners, so the company is willing to step in with solution accelerators for laws like Sarbanes-Oxley that affect large numbers of companies. For example, Microsoft will shortly update its BizTalk Server Accelerator for HIPPA, which supports compliance with the U.S. Health Insurance Portability and Accountability Act of 1996.

Accelerator Helps Document Financial Controls

Created in response to major financial scandals, such as those at Enron and WorldCom, the Sarbanes-Oxley Act is enforced by the U.S. Securities Exchange Commission (SEC). It imposes many new accounting and corporate governance requirements, such as the following:

• Section 302 requires a company's CEO and CFO to personally certify the accuracy of the company's financial reports, with penalties up to 20 years in prison for "knowing and intentional" violations
• Section 404 requires company management and auditors to document internal financial controls relevant to financial reporting and to certify their effectiveness each year
• Section 409 requires companies to disclose material changes to their business on a "rapid and current" basis.

Microsoft's Solution Accelerator for Sarbanes-Oxley aims primarily at Section 404, which has compliance deadlines of Nov. 15, 2004, for "accelerated filers" (U.S.-based companies with a market capitalization over US$75 million) and July 15, 2005, for other companies.

The Accelerator delivers components for creating "compliance sites," intranet sites for collecting documentation about a company's financial controls and tracking the documentation process. A compliance site outlines a company's financial reporting structure and key financial controls (its "control environment") and enables users to add and edit documents on the site. (See the illustration "Compliance Site and Control Environment".) The Solution Accelerator provides template forms and data lists relevant to documenting financial controls, such as forms for describing a financial control or problems with a control.

The Accelerator also provides workflow support for Section 404 documentation projects: For instance, administrators can define a series of steps that must be followed to evaluate a financial control, and users can check off steps as they are performed or "roll back" to earlier steps. Managers can obtain reports and charts that summarize the status of the project and user-supplied ratings of the financial controls.

The Accelerator generally follows the COSO framework that the SEC recommends for evaluating internal financial controls, but it can also support other frameworks or the specific interpretations of COSO adopted by individual accounting firms. (COSO stands for the Committee of Sponsoring Organizations of the Treadway Commission, an organization created in the 1980s by U.S. accounting industry groups to develop guidelines to prevent financial fraud.)

The Accelerator requires Windows SharePoint Services, Windows Server 2003, and SQL Server 2000 to host compliance sites and uses InfoPath for forms input. Office 2003 Professional Edition or Professional Enterprise Edition are recommended because they provide a better interface for working with data on the compliance site and support export of data to Excel for ad hoc analysis and reporting.

Customization Required

The Accelerator is a free download, but customers will have to customize it for their particular financial reporting process. They might also want to add features such as import of data from the company's enterprise resource planning (ERP) system or from the free Sarbanes-Oxley compliance tools that have been distributed by some auditing firms. Compliance expertise and additional software are available from a variety of third parties, including BearingPoint, Captaris Teamplate, Dell Services, Meridio, and ProActivity, as well as the "big four" accounting firms. Microsoft also intends to update the Accelerator in 2004 with additional features such as the ability to export data to third-party reporting systems (e.g., Crystal Reports).

The Accelerator is entering a field already crowded with compliance solutions from ERP vendors (such as Oracle) and specialized compliance software from vendors such as Movaris, OpenPage, and Proactivity. The Accelerator is also arriving relatively late in the game: Many companies were aiming for a June 15, 2004, compliance deadline (subsequently pushed back to Nov. 15) and are already well along in their compliance efforts. However, smaller companies and firms based outside the United States have more time for initial compliance, and all firms will need to carry out annual reviews of their controls after the initial deadlines, so the Accelerator has not yet missed its chance.

Solutions based on the Accelerator could particularly appeal to companies already using Windows SharePoint Services for intranets or InfoPath for forms-based data collection. They could also appeal to companies that have been relying on Office applications for their compliance efforts but are looking for better document management and workflow support.

In the end, however, any technical solution for Section 404 is going to be less important than a company's own commitment to putting effective, documented internal controls in place and then maintaining them as their business changes.

Availability and Resources

The Microsoft Office Solution Accelerator for Sarbanes-Oxley is a free download. It does not require Software Assurance (SA) coverage on any components; SA was formerly required for Office solution accelerators, but that requirement has been lifted.

Further information on the Accelerator and partner offerings are at www.microsoft.com/office/solutions/accelerators/sarbanes.

A high-level review of Sarbanes-Oxley compliance written for Microsoft Business Solutions customers is at download.microsoft.com/download/f/8/5/f85feed1-7141-43fb-b70e-c8b62d59e136/sarbanesoxley.pdf.

An overview of the Sarbanes-Oxley Act is at www.aicpa.org/info/sarbanes_oxley_summary.htm.

COSO is at www.coso.org.

The strategy behind Office Solution Accelerators is covered in "Accelerators to Push Office" on page 20 of the Dec. 2003 Update.