Enterprise Risk Management
Contract Drafting and Review
Your company’s agreements encompass the entire range of activities in which your business engages. I help business owners in reviewing the terms and conditions of their contracts that include leases of land, buildings and equipment, loan agreements, employment and licensing agreements, software as a service (cloud) contracts, and construction contracts along with any other material agreements to which your company is a party.. Depending on your company’s industry, additional examples of contracts I can help you review include insurance coverage, telecom services and outsourcing of services that can expose your company to substantial liability for damages to your customers and investors. I can assist you to pinpoint representation and warranty terms in your contracts that counterparties can include that can pose substantial risk to your company as well as excessive penalties and liquidated damages that could result should it decide to terminate a contract prior to its completion.
Internal Controls over Financial Reporting
A cornerstone of risk management is the identification of risks of materially misstating your company’s financial statements. Essential to mitigating the risk of such misstatements is the identification and testing of preventive and detective controls in your company’s accounting system to avoid or identify where risks can occur that materially impact its financial reporting. Your company’s manual and automated controls will depend on its industry.
An example of a key control that I can help you implement is segregation of duties to minimize the risk of combining your employees’ responsibility for custody of its liquid assets such as cash or marketable securities, with their responsibility for recording transactions involving them. If your company doesn’t have enough employees to distribute the abovementioned duties among multiple employees, a manager could be assigned responsibility for reviewing and approving transactions recorded by your employees for assets over which they also have custody. Detective controls include regular evaluations of your company’s revenue and expense accounts to determine whether they are unusually high or low compared to historic levels. Large variances in these accounts from historic averages can reveal the existence of intentional or unintentional errors in your company’s financial statements. Minimizing the risk of material misstatements in your company’s financial statements is essential to sound financial management and the credibility of its financial statements to anyone who utilizes them..
Sarbanes Oxley Compliance
Any publicly traded company subject to the continuous reporting requirements of the Securities Exchange Act of 1934 is required to comply with the Sarbanes Oxley Act. Most notable are the required certifications, typically by a company’s CEO and CFO responsible for establishing and maintaining its internal controls. Additionally, the controls they have designed must ensure that material information relating to the company is made known to these officers, particularly during the period in which the periodic reports are being prepared. . Through my extensive experience with Sarbanes Oxley compliance I can assist your company to develop the required documentation required for SOX implementation as well as in performing periodic reviews of your company’s ongoing SOX compliance. Your company’s officers must also evaluate the effectiveness of its internal controls within 90 prior to its financial reporting.
SOX 404(a) requires management to conduct its own assessment of internal controls over financial reporting and issue a report on their effectiveness Among other requirements, management is required to perform a risk based assessment consisting of a review of the design and operating effectiveness of those selected internal controls related to significant accounts and relevant assertions in the context of material misstatement risks. It is also required to understand the flow of transactions including IT aspects in sufficient detail to identify points at which a material misstatement could arise.
SOX 404(b) requires the independent auditor to attest to and report on management’s assessment of the internal control over financial reporting. However, the good news for public companies with revenues of less than $1 bn during their first five years from their becoming public is that under the JOBs (Jumpstart our Business Startups) Act these companies are exempt from SOX 404(b). While SOX compliance can be viewed as best practices for nonpublic companies, if your company is exempt from registration as a public company, SOX compliance is completely optional.
Payment Card Industry Compliance
Unlike the Sarbanes Oxley regulations that are limited to publicly traded companies, businesses that take customer credit card payments businesses may be subject to payment card industry compliance requirements. The purpose of these requirements is to protect your customers’ credit card information from being accessed by wrongdoers who can then defraud your company and its customers up to the card’s spending limit.
As a merchant that accepts payment cards from which it stores, processes and transmits the payment card information, your company may be required to build in safeguards to protect this information from falling into the hands of fraudsters who will misuse it. As a PCIP (Payment Card Industry Professional) I can help support your company’s compliance with Payment Card Industry Data Security Standards, thereby protecting your company from sanctions that can involve fines and even suspension of its ability to take credit card payments. Required safeguards can include restricting access to anywhere that your company may store this data, including physical protections such as limiting access to terminals on which this data is processed as well as electronic protections such as firewalls to prevent outside breaches. Depending on your company’s methods and practices in handling payment card data, its payment card transaction volume and how it stores, transmits, or processes it, your company may be required to report its compliance with Payment Card Industry Data Security Standards (PCI DSS) requirements. Your company’s bank or payment card brands may require its PCI compliance through an annual Self Assessment Questionnaire (SAQ) or Report on Compliance (ROC). I can assist you with identification of which report your company may be required to file along with the required documentation.
Vendor Risk Management
For any company that outsources data that can impact their financial reporting such as cloud providers, vendors that receives that data for a variety of purposes that include payroll, project or product costing, employee benefits, or other outsourced operational reporting, is required to report annually on their controls to safeguard this information. Since your company is responsible for their third party provider’s controls, it is essential to obtain and review the provider’s SOC 1 or 2 report..
I can help you review your third party providers’ SOC reports and where warranted determine that your company request their service providers’ current Service Organization Control (SOC) 1 or 2 reports. SOC 1 reports cover the fairness of the presentation at a point in time of management’s description of the service organization’s description and the suitability of the design of its controls. SOC 2 reports address the fairness of the description of the service organization’s suitability of the design and operating effectiveness of its controls during a period of time..
My review of SOC 1 and 2 reports would include a determination as to whether the opinion of the audit firm that issued it was unqualified or not, and controls that the report identified as were your company’s responsibility are in place and operating as described. Having complete and up to date documentation of your service providers’ SOC reports is essential to your company receiving a clean opinion on its annual audit.