SHRM Foundation Thought Leaders Retreat Sarbanes Oxley Section 404: Framing the Issues

1. SHRM Foundation Thought Leaders RetreatSarbanes Oxley Section 404: Framing the Issues pwc

2. Agenda

3. Workshop Objectives At the end of this session you will: • Have a general understanding of the Sarbanes Oxley Act • Understand the key steps involved in the Section 404/302 documentation and testing requirements of the Sarbanes Oxley Act • Understand common issues and findings at many companies resulting from the documentation and testing of HR cycles • Understand common implications and questions for a Company’s HR strategy as a result of the requirements of sections 404/302 of the Sarbanes Oxley Act

4. There are 11 titles in the SOA: Title I – Public Company Accounting Oversight Board Title II – Auditor Independence Title III – Corporate Responsibility Title IV – Enhanced Financial Disclosures Title V – Analyst Conflicts of Interest Title VI – Commission Resources and Authority Title VII – Studies and Reports Title VIII – Corporate and Criminal Fraud Accountability Title IX – White Collar Crime Penalty Title X – Corporate Tax Returns Title XI – Corporate Fraud & Accountability A Brief Overview of the Sarbanes Oxley Act (SOA)

5. Requires attestation by CEO and CFO and auditor over the sufficiency of key internal controls. There is a difference between the corporate audit and the 404 attestation. i.e. controls focus on how the numbers are generated while the corporate audit focuses on what the numbers are and whether or not they are correct. Just because there has never been an error in the financial statements does not mean that the controls are strong. Sections 404/302 of the SOA

6. No all internal controls are in scope of the attestation. For example, controls over compliance of HR policies and programs are not typically in scope of the review. The four main areas of focus are controls that : Mitigate the possibility of a financial restatement Provide for the security of assets Provide for approval over transactions Provide for record retention Sections 404/302 of the SOA

7. The COSO framework is the framework agreed upon by the PCAOB (Public Company Accounting Oversight Board) for addressing Sections 404/302 of the SOA. For each of the Financial, Operational and Compliance related internal controls, the company must address each step in the COSO framework: Control Environment Risk Assessment Control Activities Information and Communication Monitoring The COSO Framework for addressing Internal Controls

8. Control Activity Areas of Focus Executive Compensation Compensation • Areas most likely to have a material effect if errors occur • Areas with direct SOX impact high Payroll Health & Welfare Pensions Equity Plans SOX relevance Learning & Development Expatriate Services Training Performance Management Regional HR Management HR Administration Diversity Employment Disputes low low risk potential high

9. Develop risk assessment Scope cycles to be documented Develop risk and controls matrices Develop narratives, flow charts, and populate risk and controls matrices based upon control owner interviews Validate draft documentation with control owners Perform walk-throughs Analyze design effectiveness of controls Remediate and update documentation Perform operational effectiveness testing of controls Remediate as necessary The 404/302 documentation and testing process

10. Completing 404/302 documentation: Completing the work when internal controls and/or financial reporting are not core competencies for the HR department Justifying the HR cycles to be in-scope or out-of-scope Developing risk and controls matrices Getting our arms around – “It’s not Compliance!” How to monitor and communicate the effectiveness of key controls Common Issues HR Departments are Facing

11. Common findings of the 404/302 process for HR cycles: There are often good processes without formal controls International implications Cultural issues related to the Control Environment and formalized control activities Demonstrating knowledge of US GAAP Connection and communication among HR/Finance/Treasury/Legal Departments Reviewing work of third parties for reasonableness Centralized monitoring of executive employment contracts Common Issues HR Departments are Facing

12. Impact on the question to Outsource or not to Outsource Outsourcer oversight responsibility Internal Staffing strategies and budgets Maintaining lean internal HR department staffing while complying with segregation of duties and restricted access control requirements Outsourcer oversight responsibility Complicated compensation and benefits accounting – how much accounting and financial knowledge should reside in the HR department? Implications to compensation plan design for executives: Performance measures based upon 404 results? Board assessment of CEO? Common HR Strategic Questions Arising from 404/302 Compliance

13. Q&A

14. Mike Boro PricewaterhouseCoopers 300 Madison Avenue New York, NY 10017 (646) 394-2370 michael.boroo@us.pwc.com Carrie Duarte PricewaterhouseCoopers One International Place Boston, MA 02110 (617) 530-4597 carrie.duarte@us.pwc.com Contacts