Can Small Companies Benefit From SOX?: Just becuse you're privately held doesn't mean you can't benefit from the 'spirit' of Sarbanes Oxley.

First, what is Sarbanes Oxley? The Sarbanes-Oxley Act was designed, in the wake of Enron, Arthur Anderson and WorldCom, to protect investors by improving the accuracy and reliability of corporate disclosures. The Act itself is really about strong processes, auditor independence and corporate responsibility.

To understand the pros and cons of Sarbanes Oxley, we spoke with Dan Swanson, Director of Professional Practices at the Institute of Internal Auditors (www.theiia.org). According to Swanson, “SOX was written to protect shareholders. How can you argue with that? The basic idea behind SOX is a good one. The downside of SOX is that small public companies incur a higher percentage cost than large companies – which could be an unfair financial burden. Because of this, SOX has received more negative than positive press lately.”

However, experts such as Swanson agree, if your company is privately held, there can be real benefits from selectively applying parts of SOX and other regulations to your own business. Here are a few key areas where private companies can benefit from a system of strong internal controls:

1) Build it in on the front end: if you’ve developed best practices, how do you know they are being implemented and followed? The best way is to build controls as critical parts of processes. Regular audits, whether performed informally or formally (by an internal auditor an outside audit firm) ensure that procedures you’ve developed are followed. Jason Claycomb, president of INARMA LLC. (www.inarma.com), a controls consulting firm, advises business owners to “make sure the controls are part of the process.” As examples he says, “all accounts payable checks should be matched against invoices and approved by the appropriate person inside the company. Another example is to make sure only authorized employees can make changes in the payroll system so that you know you are paying the right amount to employees.

2) Seek objectivity. Checks and balances are important to every business, advises Larry Rieger, an executive in charge of risk and Sarbanes Oxley consulting for Crowe Chizek, a national accounting and consulting firm. “Sarbanes Oxley stresses the importance of objectivity from your service providers,” said Rieger. “In other words, don’t hire the same firm for audit as you would for IT security. You don’t ever want to create a situation where a vendor is auditing itself.”

3) Network security makes you stronger: According to Patti Suarez, a Global Information Security Manager with the Wm. Wrigley Jr. Company, “network security is about more than just viruses – it means you are taking time to think about the things your business values and building processes to protect those things. It doesn’t matter if you are a big or a small company. What matters most is that your processes instill confidence with your employees, vendors and customers.”

4) Get real advisors: Don’t shortchange the idea of a real board of advisors – a group of people you respect that will tell you what you don’t necessarily want to hear. “No employee wants to tell the emperor that he has no clothes,” says Maryann Correnti, a risk management practice leader for American Express Tax and Business Advisory Services, “Building a strong outside advisory board, a group of peers, people that you trust, not a committee that rubber-stamps all your decisions can help you improve controls and grow your business."

SOX was designed to protect shareholders, and as your company’s biggest shareholder--your job is to protect yourself, your customers, your employees and your vendors. Building and improving your corporate controls can help you protect your investment in your business.