"What Small Businesses Need to Know in Today's Regulatory Environment"

If you receive errors when attempting to view this white paper, please install the latest version of Adobe Reader.

""
Source: SAP

Resources Related to What Small Businesses Need to Know in Today's Regulatory Environment:

• Sarbanes–Oxley Act(SOX) (Wikipedia)

What Small Businesses Need to Know in Today's Regulatory Environment

Executive Summary

An entrepreneur running a small-to-medium sized business today faces a daunting task. Just a few years ago, a company that could develop a strong business plan, have a break-through product or service providing a competitive edge in the marketplace and build strong and effective distribution channels was thought to have all of the prerequisites of success. The complexities of today's business world, however, have created new risks, a myriad of regulations and complex reporting requirements that can overwhelm a lean and focused organization, regardless of its size.

While there has been considerable discussion concerning the legislative intent surrounding the impact of SOX requirements on private businesses, there is no doubt that owners and managers of most enterprises, even smaller private ones, need to be cognizant of both the spirit and the letter of the law. In fact, in a survey by Robert Half Management of 1,400 CFO's of private businesses, 58% are implementing changes as a result of corporate governance regulations.

Again, all important stuff, but how does a smaller organization, with limited resources, cope with all of this? Perhaps more importantly, how do they stay abreast of the additional changes that are sure to be on the way? The only sensible answer is through technology. Many tools have been developed that can greatly simplify the process. Before they can benefit from this technology, however, small business man- agers must select the right tools.

A businesses' technology needs grow and change almost as rapidly as their operations. There are so many applications, accounting systems and management systems on the market that confusion and reticence are understandable reactions. At some point in time, a growing private business is likely to need more than just an accounting application. It will need a more complete technology solution to support that growth. Larger enterprises have commonly moved to ERP solutions to address this need and products are now being offered that bring much of this functionality to smaller companies. When evaluating ERP software, one question that is commonly asked is:"Is it Sarbanes-Oxley compliant?" Software companies may respond to this question in a variety of ways, some more candidly than others. The fact is, that's probably the wrong question. A more appropriate question might be whether a soft- ware package will support management's efforts at developing the appropriate processes and controls that enable compliance and more importantly, will it be a useful tool for management as it goes about the business of competing effectively in the marketplace. Those are the more relevant and on-point questions a business owner or manager should be asking themselves, their advisors and any technology vendor.

In the following whitepaper, Peter Russo discusses the concerns that are keeping owners and managers of small businesses up at night and outlines suggestions for coping with those concerns.

Small Business and the Concerns About Regulatory Compliance

An entrepreneur running small-to-medium sized business today faces a daunting task. Just a few years ago, a company that could develop a strong business plan, have a break- through product or service providing a competitive edge in the marketplace and build strong and effective distribution channels was thought to have all of the prerequisites of success. The complexities of today's business world, however, have created new risks, a myriad of regulations and complex reporting requirements that can overwhelm a lean and focused organization, regardless of its size.

Some of the challenges that the company might face include:

• Increasingly complex Generally Accepted Accounting Principles (GAAP). While much of the change has been driven by issues faced by larger companies, all US businesses are subject to the same rules. There has been some discussion of creating a separate set of standards for smaller private companies for exactly this reason.
• A company operating internationally may be subject to both US GAAP and International Financial Reporting Standards (IFRS) and subject to a myriad of rules relating to the measurement of profitability, asset valuation, liability recognition, disclosures, etc. A company with reporting units in the US and abroad might find a need to apply different standards. These rules are ever changing, particularly given the movement toward convergence of these standards. In recent statements, the SEC, the FASB and the IFRS have jointly announced a timetable for convergence by 2009.
• Any smaller company operating globally may also face risks from currency fluctuation, assuming they are buying or selling products in multiple currencies. If they sell products abroad, they may also face challenges to their inter-company transfer pricing from taxing authorities.
• Any company with employees is subject to a variety of state and federal laws that govern how a company hires, fires, pays, and classifies its employees. There are even complex laws that determine who a company's employees are.
• Businesses of all sizes may be required to protect the privacy and the integrity of third party information. In the health care industry, for example, the Health Insurance Portability and Accountability Act (HIPAA ) has forever changed the playing field for anyone subject to its requirements.

In discussions about the "three R's" (reporting, regulation and risk) these days, however, there is no issue that approaches Sarbanes-Oxley ("SOX"), in terms of the attention that it has generated and the level of concern that it has created in organizations of all sizes.

The Sarbanes-Oxley Act of 2002 was passed largely as a result of the corporate scandals of the late '90s. SOX has had an enormous impact on businesses of all size. In an attempt to restore investor confidence SOX has set significantly higher corporate governance and financial disclosure standards, as well as requiring the establishment, review and reporting, both internal and external, on the systems of control surrounding and supporting the business processes currently in place. Publicly held companies continue to scramble to meet the law's requirements. But if SOX applies to public companies, why are private companies of all sizes concerned about compliance?

While there has been considerable discussion concerning the legislative intent sur- rounding the impact of SOX requirements on private businesses, there is no doubt that owners and managers of most enterprises, even smaller private ones, need to be cognizant of both the spirit and the letter of the law. In fact, in a survey by Robert Half Management of 1,400 CFO's of private businesses, 58% are implementing changes as a result of corporate governance regulations. There are a number of reasons driving this evolution such as:

• Senior managers of a growing, thriving private company must have an eye on the future, whether that includes making acquisitions, being acquired, a public offering or a significant capital infusion through the issuance of equity or debt. Funding the company's future and meeting the liquidity needs of investors is of prime importance and it is imperative that management take seriously the development and effectiveness of business processes that will support these strategies.
• Any company planning an IPO in the future will be subject to the regulations and implementing SOX can significantly delay the offering. In fact, a company with significant internal control issues might very well miss an IPO window.
• A company hoping to be acquired by a public company might find that they are a significantly more attractive target if they have addressed their SOX issue in advance.
• Any company raising equity capital from outside professional investors, including venture capitalists and other private equity firms will probably find that the investor insists on some level of SOX compliance, to protect their interests as investors and the company's opportunities to pursue a liquidity event.
• Companies who are important suppliers of public companies are finding that their customers are increasingly interested in the level of controls they have over their business processes. They, in effect, are part of their customers' SOX compliance efforts.
• Any company that relies on an independent Board of Directors will find that the Board redefines its own standard for governance as its members become more cognizant of the guidelines that SOX prescribes. At a minimum, many companies will address issues of director independence and create independent audit and compensation committees, if they haven't already done so.
• Perhaps the best reason of all for a private company of any size to be interested in Sarbanes-Oxley is that SOX has significantly raised the bar or corporate governance and internal control. Any company that strives for excellence by benchmarking should view SOX as a unique opportunity to earn from public companies who are defining best practices to mitigate risk, improve processes, and raise credibility among stakeholders and other constituents.

The one section of SOX that has drawn the most attention (and certainly the most distain) is Section 404, which focuses on a company's internal controls and financial reporting procedures. Management is required to identify the activities that are key to the business, demonstrate sound financial controls governing those business processes and test those controls quarterly. Management is then required to report on its findings as to the adequacy of the system of internal controls and have out- side auditors conduct their own review of the internal controls and independently report their findings as to adequacy. While few private companies will fully comply with Section 404, many companies will find opportunities for improvement that are applicable to their own businesses in the practices of public companies.

Rather than viewing the current environment as the age of overbearing government and regulation, founders, owners and senior management of private companies should recognize an opportunity to transform their business. Companies that develop the systems, processes and controls that enable them to manage their business growth on a day-to-day basis as well as foresee problems and initiate proactive decisions will have a huge advantage over their counterparts who are in a continually- reactive mode.

Another area that has received a lot of attention recently is Enterprise Risk Management. The Integrated Framework was commissioned by the Committee of Sponsoring Organizations of the Treadway Commission - commonly referred to as COSO. It provides a benchmark for organizations to consider in evaluating and improving their enterprise risk management processes. COSO recognized a need for a broadly accepted ERM framework in order to establish common definitions, a direction for organizations to use in determining how to enhance their risk management and criteria to enable them to evaluate whether their risk management is effective.

Again, all important stuff, but how does a smaller organization, with limited resources, cope with all of this? Perhaps more importantly, how do they stay abreast of the additional changes that are sure to be on the way? The only sensible answer is through technology. Many tools have been developed that can greatly simplify the process. Before they can benefit from this technology, however, small business man- agers must select the right tools.

A businesses' technology needs grow and change almost as rapidly as their operations. There are so many applications, accounting systems and management systems on the market that confusion and reticence are understandable reactions. At some point in time, a growing private business is likely to need more than just an accounting application. It will need a more complete technology solution to support that growth. Larger enterprises have commonly moved to ERP solutions to address this need and products are now being offered that bring much of this functionality to smaller companies. When evaluating ERP software, one question that is commonly asked is:"Is it Sarbanes-Oxley compliant?" Software companies may respond to this question in a variety of ways, some more candidly than others. The fact is, that's probably the wrong question. A more appropriate question might be whether a software package will support management's efforts at developing the appropriate processes and controls that enable compliance and more importantly, will it be a useful tool for management as it goes about the business of competing effectively in the marketplace. Those are the more relevant and on-point questions a business owner or manager should be asking themselves, their advisors and any technology vendor.

The problem with the "Is it compliant?" question is that it is impossible to answer. No software makes a company compliant with Sarbanes-Oxley or any other regulation or reporting requirement. All a product can do is assist management in putting in place suitable processes, adequate controls and assist in the documentation and auditing of those processes and controls. It's a key truism: Management makes decisions about whether or not to comply and what it takes to comply as well as determining if the level of compliance is adequate and effective. The design of those processes must always be management's responsibility. When we think about the SOX-like needs of private companies, the utility of a particular software solution becomes even more ambiguous. Since full compliance with the requirements of the act is neither required nor a likely goal of a smaller private company, any software product should be measured against the company's objectives. Once management has articulated those objectives, they can intelligently evaluate whether and to what extent any software product will support its efforts to achieve them efficiently and effectively.

Based upon my years of experience as a CFO, CEO and now director and/or advisor to a number of emerging growth companies, I think there are a number of criteria against which a company can measure an enterprise software solution in today's environment:

• Integrated approach - to the extent that a single software product allows a company to integrate the various aspects of the business (accounting, production, human resources, CRM, budgeting, etc.),management can take a "holistic" view of its business processes and compliance issues. Information, whether used for management decisions, financial reporting or record keeping, should come from a single source.
• Business process should dictate the software solution - and not the other way around. Management should determine the most appropriate business practices and processes for its business at a point in time, and select a product that supports these. Any process that is driven by the need to comply with an inflexible software solution represents a possible inefficiency or worse, a potential internal control problem.
• The total cost of ownership - must be justified and affordable. When considering the cost of a software solution, the "price" is often just the "tip of the ice- berg". A company will often spend several times that price in implementation, ongoing maintenance and support and customization. Only when weighing all of these factors can a company determine the true cost of the solution.
• Scalability - can that technology grow as rapidly and as efficiently as management foresees the business growing? As costly and painful as an ERP implementation might be today, it may be that much more costly when the company has grown to several times its size. Part of the true cost of ownership is the answer to this question.
• Ability to "manage by exception" - when weighing a software solution's ability to support management's approach to compliance with any set of regulations, covenants or standards, a critical factor is how easily and reliably the product can call management's attention to situations where they have or may soon be breached. Any solution should give management the ability to set any number of rules or audits and create alerts for the appropriate people. Audit trails must be easily followed and maintained.
• Ability to support multiple locations around the globe - given the fact that today's emerging growth companies are likely to have some presence in multiple countries and deal in multiple currencies early in their life cycle, a software solution should provide the ability to work in multiple currencies and multiple languages. The accounting system should be robust enough to allow multiple locations to manage their own needs, while supporting integration of information at the highest level.

I was recently asked to look at SAP's Business One business management solution and evaluate it against my own criteria. I must say that I was very impressed that all of the requirements outlined above appear to have been addressed in a sensible and efficient way. For example:

• All of the modules of Business One appear to be tightly integrated. It is easy to see how information in one module finds its way to the others. I was particularly impressed, for example, with the CRM product and how it can be used to track activity with business partners from first contact through transaction.
• The Business One product seems to have been designed with flexibility in mind. Users can easily customize the product to fit their own business processes. The architecture of the system was designed with this in mind, since Business One is a more "horizontal" product than SAP has typically been known for, and much of the customization is left to the customer.
• SAP designed Business One to be affordable to smaller companies and have a pricing model that appears to be very competitive with other products designed for this marketplace. They also appear to have designed an implementation process with affordability in mind. Their Data Migration Toolkit, for example, can greatly simplify the process of migrating over to Business One from another platform. The Software Development Kit (SDK) was specifically designed to allow users to create a custom version of Business One, making the inevitable process of customization as painless as possible. The fact that SAP has designed this product to be sufficiently robust to serve the needs of companies until they are ready to migrate to the mySAP All-in-One solution indicates that their customers should not quickly outgrow its capabilities. Once they do, SAP has another solution and a pre-designed migration path available.
• SAP Business One allows a user to develop an unlimited number of "alerts", to identify situations requiring management's attention in a proactive fashion, as opposed to reacting after a crisis has arisen. These might include variances from budget, unusual quotations to customers, cash flow issues, or non-compliance to the company's procedures. Use of these alerts might enable a more proactive approach to managing a business, as opposed to reacting to the latest crisis. The built in audit trail will document the setting of these alerts, any changes to them and compliance.
• SAP Business One was conceived as a global solution. It supports multiple languages and currencies. The chart of accounts has sufficient available fields for a company to designate multiple divisions and locations.

In summary, I came away very impressed with SAP Business One. My original concern was that SAP might have just watered down their mySAP All-in-One solution for the small-business market. In fact, the product was developed from the ground up for smaller enterprises and it shows. I found the interface to be rather intuitive and easy to grasp. Implementing SAP Business One will not "solve" an emerging growth company's regulatory or compliance issues. On the other hand, I can see how this product can be a valuable tool for management as it tries to address the increasingly complex demands that it will face.

© Copyright 2005 SAP AG. All rights reserved.
No part of this publication may be reproduced or transmitted in any form or for any purpose without the express
permission of SAP AG. The information contained herein may be changed without prior notice.
Some software products marketed by SAP AG and its distributors contain proprietary software components of
other software vendors.