by Seth Fineberg
Business opportunities related to Section 404 of the Sarbanes-Oxley Act are not just for CPA firms anymore.
A growing number of technology consultants and accounting product resellers are starting to see how they, too, can gain from the public company reform bill.
While many regional CPA firms have discovered a new niche in taking on 404 compliance work, in many cases forming separate divisions of their own firms devoted to the area, it appears that tech consultants are not far behind in their thinking on the subject.
Granted, most CPA firms that are involved in any SOX compliance work at all have only done so over the past year or so, with more waking up to this niche service regularly as the deadlines for compliance approach. But when it comes to Section 404 work, CPA firms and tech consultants, who often partner on software and infrastructure installations, are slowly discovering how each can be an asset in this area as well.
Lynn Berman, president and chief executive of Livingston, N.J.-based Best Software reseller and tech consultancy SWK Inc., believes that firms like hers need look no further than their own skill sets to see how valuable they can be to a CPA firm conducting 404 compliance. In her view, the main aspects of 404 compliance work involve several key tasks, including creating risk assessments; examining the control environment; documenting control activities; examining information and communication processes; and monitoring and testing. These are activities that she said many tech consultants already do well.
“The IT professional knows security, redundancy, communications systems, recovery, Internet applications, and is a general software pro. You are testing physical environments and CPAs just don’t do that,” Berman said. “You may have clients that have a concern about security exposure, so you end up doing the same kind of testing as you would for 404.”
Berman recently addressed these issues during a session on Sarbanes-Oxley and 404 opportunities for CPA and tech firms at the AICPA Information Technology Conference, last month.
SWK is one of the few tech firms to have completed a Section 404 compliance engagement, and was in the planning stages of two more at press time. Regardless of what she deems a success in her firm’s first engagement, Berman advised that 404 compliance work is not something that tech firms should just jump into, especially without a solid partnership with a CPA firm.
“We did a lot of reading first to decide we could do it, such as reading about what documentation is and what’s required,” Berman said. “There are a lot of materiality issues. You need to understand whether it is one location, is it 20 locations, and how many need to be tested? You have to go by what’s represented and you have to really project-manage very carefully the whole way.”
SWK ran into some difficulties in its 404 compliance engagement for a “large cap, international electronics company with 300 employees and 15 locations,” which she said is to be expected.
Berman said that she had problems with the company’s auditor — whom she declined to name — which let SWK complete most of the 404 engagement without helping, despite a pre-engagement promise that it would.
The entire job, from planning to completion, lasted from October 2003 until March 2004, which may have been faster than SWK or Sobel & Co. — a second CPA firm partner on the deal — had expected, but it is work that will be needed again in a year. It may not be as detailed as the first job, but it is still recurring revenue.
The CPA perspective
Sobel is also reviewing proposals from several technology consulting firms for future 404 work, according to the head of the firm’s 404 practice, partner Peter Levy. He believes that the partnership between CPA firms and technology consultants is essential for anyone considering 404 compliance work.
“I think 404 work is the perfect marriage between consulting and internal controls,” Levy said. “We have a list of commonly missed areas, things that companies and management don’t think of, like looking at the tax situation, employee benefits, and, of course, information technology, which represents the greatest challenge and opportunity for people doing 404 work.”
Levy stressed that CPA firms shouldn’t just go to any tech consulting firm for this kind of partnership — they should either choose one that is already established, or at least select a company that can “see the larger picture and not miss any steps.”
“The single most important part of this kind of work is planning, and we brought the tech partner in right away,” Levy said. “We like to rely on a strong technology firm. You want it well mapped, clearly communicated and cost effective, and the only way you can do that is to bring in subject matter experts and the right partners. It’s a huge mistake for management or a tech firm to think they can do this on their own.”
As many technology consulting firms are coming off lean times, they are under continued pressure to consider new revenue streams and expanded services. While Section 404 work may not be on everyone’s radar just yet, resellers and tech consultants like Washington area SystemLink Inc. and Encino, Calif.-based ITG are among those strongly considering this new service.
SystemLink president David Beck said that he has been considering expanding into 404 work for several months, and has even had conversations with Berman and ITG principal David Cieslak, among others, about exactly what is involved and how to go about engaging in 404 work.
Berman stressed that any tech firm considering 404 work must start with a good CPA partner and careful research. Beck agrees and believes that his firm is closer to being able to say to a firm, “We do this,” but it has been a several-step process.
“We are at a point now where we are going to put together a marketing plan and start going to CPA firms and say we are going to do this. We are looking for more things that are pure consulting and not have it tied to a vendor,” Beck said. “We have already established internally that we have the skill set to do it, but there still is no set methodology around these kinds of services, no real checklist of things to do to get involved. We are still going to give it a try.”
