This "case study" is the latest in a series of articles aimed at helping public companies understand how other organizations are using technology to comply with new regulations and standards. These are not advertisements or marketing vehicles for the companies mentioned; Compliance Week's editorial staff speaks with the public company that has deployed the technology, and the article is written without the input—and in many cases the knowledge—of the vendor.

DETAILS

THE COMPANY

Company

Argosy Gaming

HQ

Alton, Ill.

Employees

6,438

Industry

Gambling

'04 Rev.

$1 billion

'04 Net

$61.5 million

THE CHALLENGE

Argosy Gaming, which owns six riverboat casinos in the Midwest, needed an IT system that could both automate its Section 404 testing, and serve as a springboard for future compliance initiatives.

SOLUTION CHOSEN

A content management solution from Eden Prairie, Minn.-based Stellent.

Related Resources

Click Here For Other Recent CW Case Studies

Stalling For Time

As Section 404 of The Sarbanes-Oxley Act bore down on corporate America in 2003, Argosy Gaming had one significant advantage: a pre-existing set of 1,400 strong internal controls.

As a result, says vice president of internal auditing Craig Robinson, the company's key challenge became one of "document management"; Argosy didn't need to identify and codify controls, it simply needed to organize and track them better.

But when Robinson says the process was a chore, he means it: Argosy routinely churns out 100,000 documents every day.

What’s more, gambling is among the most heavily regulated businesses in the United States; Sarbanes-Oxley aside, Argosy faces myriad regulatory requirements, both state and federal.

So when SOX 404 arrived, Robinson and the rest of Argosy’s steering team saw a strategic opportunity: Adopt a platform for governance that could handle multiple compliance programs.

“We wanted a product to take care of our short-term needs to make us 404-compliant,” Robinson says, “but a product that also scaled and could be a backbone of document retention, with a Sarbanes module built on top of it. We didn’t want to recreate the wheel every time we wanted to expand.”

Argosy’s first move was to stall for time. Rather than purchase the first Section 404 automation tool he could find, Robinson decided to do 2004 documentation and testing manually while he looked for a permanent solution. His staff stored controls information in a SQL database, planning to port that data to whatever software tool Argosy would ultimately purchase.

[Structured Query Language or "SQL" is a standard computer language used to query and update information in large relational databases].

“We could get the first year behind us and understand the process,” he says. “Then our second-year goal would be to automate the function and get a tool in place.”

Immediate Discard

Argosy waged its manual attack on Section 404 in the first half of last 2004. According to Robinson, an outside firm handled documentation, while Argosy's internal audit group conducting necessary testing.

By the third quarter, when Robinson knew Argosy would meet its December 2004 certification deadline, he began looking for software tools to automate the process in future years.

Robinson identified 16 possible software vendors that claimed to have a relevant Sarbanes-Oxley solution—and almost immediately discarded most of them. “The one thing that weeded a lot of them out was that they had a primary focus on Sarbanes compliance, but had only a partnership with a document-management firm or hadn’t developed that part yet at all,” Robinson explains. “We didn’t want to be the guinea pigs.”

Only two vendors made Robinson's short list.

Argosy' ultimately selected Stellent, a publicly traded software company based in Eden Prairie, Minn., that provides content management solutions to a number of large companies, including Boeing, General Motors, Verizon, and Bristol Myers Squibb. The company's solutions have been used to help organizations facilitate compliance with a variety of regulatory requirements, like HIPAA, the Patriot Act, and—of course—Sarbanes-Oxley.

Argosy particularly liked the fact that Stellent was eager to enter the complicated gambling industry. According To Robinson, Stellent “recognized the fact that the gaming industry is way too document-intensive right now, and wanted to help us find ways to streamline those operations.”

To facilitate the process, Stellent’s executive vice president met with Robinson to discuss the company's particular requirements, and Stellent actually consulted with Argosy’s other software vendors the better understand the company's particular document management needs.

The deal was closed at the end of 2004.

Ownership And Dashboard

According to Robinson, the implementation process has been swift and mostly painless.

For example, Argosy only began implementing the Stellent system in January 2005; the project was scheduled to be completed by Feb. 28, and it went "live" on that date. In an interview one week before the deadline, Robinson described the implementation as “relatively easy," noting that Stellent had been "very forward in telling us what their needs are.”

Stellent also apparently did a good job of meeting Argosy's needs.

For example, one of Robinson's initial goals was to push ownership of Section 404 compliance down to the operating casinos; the company operates six riverboat casinos in Illinois, Missouri, Louisiana, Iowa, Indiana and Ohio. During the initial phases, though, the company deliberately kept the project under corporate control, paying all costs out of headquarters to ensure management fully understood the process and its implications.

But since casino managers’ compensation is partly based on the performance of individual properties, Robinson wants local executives to participate fully in controls certification.

“We want … to get the controls and procedures closer to the hands that of those people who deal with them on a daily basis, but at the same time we don’t want to just push it all out there and hope it comes back,” Robinson explains. “We want the ability to monitor it and keep tabs on it, so we don’t have any surprises at year-end.”

To those ends, it was critical that the system include a “dashboard” of data for Argosy’s chief executive and financial officers, so they could examine controls data for quarterly attestations as required under Section 302 of SOX. “What [the executives] want is that at any given time they can look at the software and look at the risk areas right now and basically get a snapshot of where we sit on any given day,” Robinson says.

Robinson will start handing over 404 compliance responsibility to local managers in April.

In the longer term, Robinson says, Argosy might expand the Stellent system to include a number of related features like email management; currently, Argosy pulls archived emails from backup tapes when it needs to retrieve old messages. Other options Argosy is considering include disaster recovery, and archival of vital documents in the system’s central database.

“Just based on buying a document-management backbone, with a Sarbanes module on top of it," notes Robinson, "our IT people now are starting to see what other benefits we could get,.”

Advice To Others

When asked to contribute "lessons learned," Robinson doesn't hesitate: Take your time.

Above all, Robinson notes that companies should move with deliberate speed when considering solutions related to Sarbanes-Oxley Section 404. That's partially because the purchasing decision is a complicated one, with vendors offering a wide range of platforms for governance and compliance; solutions as disparate as document management, IT security, business process management, and even "communications management" have been described as SOX 404 solutions.

In addition, notes Robinson, the time pressures related to SOX 404 deadlines can tempt executives to act quickly rather than wisely. “It saved us a lot of headaches, that we didn’t implement something in 2003 that was the best out there at that point in time, because we didn’t want to worry about migrating to a different tool that might come up,” he says.

“Don’t say, ‘Oh my God!’ and throw as many people as possible at it right away," adds Robinson, "Maintain that view of the forest through the trees.”

Topics