Arecent survey suggests that nearly 70 percent of European companies are only at the beginning stages of their Sarbanes-Oxley Section 404 projects, and that many of them are all but ignoring the whistleblower provisions of SOX 301.
The study, conducted by Netherlands-based consulting firm A.R.C. Morgan, surveyed 376 companies from 21 European countries. Most respondents were in finance or internal audit-related positions.
European companies registered with the SEC, along with other foreign issuers in the EMEA (Europe, Middle East and Africa), must comply with Section 404’s internal controls provision for fiscal years ending on or after July 15, 2005.
However, more than three-quarters of respondents said they were either in the assessment or documentation stages, widely considered the first of five stages. 11.7 percent were in the testing phase, 2.2 percent were in the remediation stage, and 1.7 percent said their efforts were completed.
Lewis
According to A.R.C. Morgan partner Colin Lewis, 97 percent of EU companies have year-end December 31, 2005, as the compliance date for Section 404. "We found that the majority are not taking heed of the time ’under-estimation’ learned by U.S. companies with their 404 projects, and therefore EU companies still believe that they will be prepared despite the ’stuttering’ approach."
Lewis noted that most responding companies indicated that they would "start their [SOX 404] projects in earnest at the start of the new fiscal year."
Regarding the whistleblower provisions of SOX, EU companies have until July 31, 2005, to comply.
According to the results, 43 percent of companies surveyed had not yet set up an anonymous whistleblower facility. Of the other 57 percent, more than three-fourths used an in-house system, which many Big Four auditors say does not go far enough to qualify as anonymous or independent.
While most U.S. companies were able to implement whistleblower systems quickly due to established relationships with phone-based hotline providers—most of which were established to address sexual harassment or other HR-related self-reporting mandates—Lewis believes the process will be more challenging for EU companies. "EU countries have different approaches to ‘complaint hotlines’," he notes, "the majority preferring to keep the lid on HR issues internally.” In France, notes Lewis, it is typically against corporate culture to speak up against a colleague.
In addition, the A.R.C. Morgan survey found that many companies did not understand all the requirements of the whistleblower provision, and thus have not communicated the program to employees even if one is in place.
Predictably, a large number of companies said they were finding it difficult to balance SOX compliance efforts with International Financial Reporting Standards and local government requirements.
The survey results from A.R.C. Morgan have been made available to Compliance Week subscribers in the box above, right.
No comments yet