I have posted a PDF copy of my slides from the Idiom webinar. If you haven’t read our white paper on DITA, you can download it here.

The Sarbanes-Oxley Act doesn’t just impact US companies.  Non-US
companies listed on US stock exchanges must also comply with the act.  Many
of them don’t like it.  Here is a good
article in The Register with a dateline of January 11 that provides a
quick summary.

This morning I attended a workshop on the impact of Sarbanes-Oxley on
nonprofit organizations.  The combination of SOX and nonprofits intrigued
me.  Since Sarbanes-Oxley is all about public companies, with rules issued
by the SEC, my impression was that the connection between SOX and nonprofits was
zip.  It followed that the workshop was likely to be either very
interesting or very short.

It turned out to be very interesting.

Boiled down to essentials, there at least four ways in which the governance
and internal control concerns intersect with nonprofit organizations:

• The "whistleblower protection" in section 1107 of
  Sarbanes-Oxley, which provides substantial penalties for any retaliation
  against employees or others who provide law enforcement officers with
  information about possible violation of Federal law, applies to nonprofits
  as well as to other kinds of entities.
• The penalties for document destruction in section 802 of
  Sarbanes-Oxley also apply to nonprofits.
• As SOX applies to more and more for-profit entities, parts of it are
  emerging as the expected standard of performance in the eyes of public and
  private funding sources.  At the very least, nonprofits should expect
  that expectations regarding conflicts of interest, audits, and evidence of
  internal controls will increase and will follow the general outline of SOX
• Some states are beginning to consider state regulations that impose parts
  of the COSO framework and other aspects of SOX on nonprofits. 
  California has already passed such legislation.  (For a summary of
  other state activity, take a look at this
  document from the National Council of Nonprofit Associations).

Practically speaking, my sense was that the most immediate impact on
nonprofits from a content management point of view was that, regardless of size,
these organizations need to document policies and procedures and ensure that
they are available and that they are used.  The focus of this effort
should, of course, be on staff and on board members, but should also extend to
volunteers who act as agents of the organization.  The policies and
procedures should include mechanisms for handling employee complaints and
document retention and destruction, in accord with SOX requirements.  They
should also, of course, deal with broader internal control issues such as
handling cash, soliciting and accounting for donations, making bank deposits,
and so on.

Last fall Ernst & Young published the results of a survey on trends in the implementation of internal controls,
focusing in particular on the progress that companies were making in meeting
Section 404 deadlines for Sarbanes-Oxley.  Since the publication date was
last October, this isn’t breaking news … but the existence of the survey was
news to me and I found it useful and interesting.  (You can get to the
Acrobat file by clicking here.)

The general message is (surprise!) that companies were finding that it was
taking much more effort than they expected and that they were not, in general,
sticking to the schedules they had put into place earlier.

But there are also findings that are a more surprising.  Here is an
example:  59% of the companies surveyed said that they were tracking their
testing and remediation work in an Access database or an Excel spreadsheet ( !!)
.  The implication is that these companies are not at all able to provide
real-time information about remediation across the organization.  Bummer.

Here is another one:  nearly 30% of the companies surveyed had not yet
selected a technology platform for 404 compliance implementation.  Since
these companies will have, in general, met their initial deadlines without
making a platform commitment, that suggests that there are a good number of
companies that have worked through the first round of 404 issues without making
a big technology buy.  These companies are in a good position to bring
clear expectations and requirements to their planning and purchasing.

2005 is the year that Section 404 internal controls become required for all
SEC filers, not just the accelerated filers. It is a pretty good bet that there
will be more companies coming to terms with the issues highlighted in the
E&Y survey.  It is worth a look if you haven’t seen it.