New Programs Ease Sarbanes-Oxley Transition

Within one week of each other last month, Oracle and Microsoft released products that help companies meet Section 404 of the Act, which mandates that companies attest to the adequacy and efficiency of their internal controls and processes. Microsoft's Office Solution Accelerator for Sarbanes-Oxley also addresses Section 302, which requires C-level executives to certify their company's quarterly results.

"Section 404 is where most companies are spending their time and money," said Steve Miranda, vice president of financials applications development at Oracle, Redwood Shores, Calif. "It's what gives teeth to the mandate for realtime disclosure."

Under Section 404 of Sarbanes-Oxley, companies must document all internal processes that could affect the bottom line, such as the flow of work related to travel expenses, accounts payable, procurement and even quality assurance. Sarbanes-Oxley also demands that companies identify possible risks, create controls to mitigate each threat and document those controls.

Microsoft's latest Solution Accelerator--based on Microsoft Office and integrated with Microsoft Windows Server 2003, Windows SharePoint Services, Office InfoPath 2003 and SQL Server 2000--addresses these recurring needs of internal control documentation, monitoring and testing. In a change from a previously announced policy, Microsoft now says this downloadable add-on,comprising sample code, templates and other customizable functions,is free to all Microsoft Office customers. When it announced the accelerator last December, the Redmond, Wash., company said only Software Assurance licensees could make full, free use of the software.

Aimed at channel partners and ISVs customizing Office to Sarbanes-Oxley requirements, the accelerator enables partners to define documents and their properties. Partners can then customize workflow for each document type, alert workers via e-mail when documents have been created or modified, and display a document's status.

Microsoft ISV partner Captaris, Bellevue, Wash., used the accelerator to enhance its own compliance software, called the Captaris Teamplate Sarbanes-Oxley Accelerator. Captaris' product provides the workflow and controls needed for Sarbanes-Oxley sections 404, 302 and 409, which require speedy disclosure of material events.

"The [Microsoft] accelerator is a flexible tool so you can use it to execute pretty much any compliance methodology you want," said Ken Montgomery, Captaris solutions marketing manager. "We took our Teamplate Workflow software and integrated it with the accelerator to connect all of a company's documents. We even have workflow so that companies can test their internal controls. Plus, we can integrate our software with third-party records management applications for archiving and long-term data storage."

Oracle's version 2.0 of Internal Controls Manager operates higher up the food chain than Microsoft's software and, at $30 per company employee, commands a decidedly higher price. Miranda said Oracle has no reseller arrangement for Internal Controls Manager, although channel partners will receive a commission when they influence a deal.

Part of Oracle's e-Business Suite, the financials application now supports regional variations for such processes as withholding taxes, bills of receivables or different lines of business.

The application also features tighter integration with Oracle's project management application, making it easier to divide and manage the efforts of organizations' Sarbanes-Oxley compliance teams. This feature also allows auditors to record evaluations of their customers' processes, controls and risks. The new version now enables business managers to certify their processes and distribute their certifications to others in the control hierarchy.