sap and sarbanes-oxley act

2005-11-29T21:57:00.000-08:00

An Internal Control Guide

1 Documentation Audience
This guide provides information for consultants, controllers, and internal auditors about the internal control features pre-configured in the Baseline Package (US). It assists customers in complying with the internal control documentation requirements mandated by the Sarbanes-Oxley Act; but it cannot substitute for customers’ own documentation. SAP recommends that users work closely with external auditors to ensure that they are in compliance with the Sarbanes-Oxley Act.

This guide addresses the following areas:
Baseline Package (US) support of typical internal control features in terms of internal control objectives
Business process procedures and documentation related to topics discussed in this document
Preconfiguration for automatic account determination
Building block configuration guides that provide detailed information about Customizing

2 Background
The Sarbanes-Oxley Act (SOA) was enacted by the US Congress on July 30, 2002 and applies to all companies registered with the Securities and Exchange Commission (SEC). A registered company is one that is traded on a US stock market (NYSE, NASDAQ). SOA establishes heightened requirements in corporate governance, financial disclosures, and accountability for fraud. Specifically, it requires organizations to periodically evaluate and certify the effectiveness of their internal controls.

SAP anticipates that countries outside the US will also establish SOA-type requirements (for example, in February 2003 the German government issued a 10-Point Plan on corporate governance standards).

Sections 302 and 404 of the SOA have specific requirements for internal controls:

Section
Requirements
302
Management responsibility for effective disclosure controls and procedures over financial reporting, operations, and compliance
Disclosure of significant deficiencies in internal controls to audit committee and external auditors
Certification of contents of SEC reports by CEO and CFO

Further periodic disclosure requirements are covered under Section 302
404
Management report on the effectiveness of internal controls over financial reporting must be included in annual report.
Documentation of control design and effectiveness testing
Disclosure of any material weaknesses
Certification by external auditors

For accelerated filers (generally everyone but small business securities issuers), Section 404 requirements are effective as of fiscal years ending after June 15,2004. For all others, including foreign private securities issuers, the rules are effective as of fiscal years ending after April 15, 2005. SAP advises customers to consult their legal counsels to determine their effective compliance date.

The SEC defines internal control as a process carried out by an entity’s board of directors or management and other personnel that is designed to provide reasonable assurance that control objectives are met in the following categories:
· Reliability of financial reporting (our focus)
· Effectiveness and efficiency of operations
· Compliance with applicable laws and regulations

The effectiveness of internal control is usually assessed in terms of the following objectives:

Validity - All transactions processed are valid
Completeness - All transactions are included
Timeliness – All transactions are recorded on a timely basis
Authorization – All transactions are properly authorized
Valuation – All transactions are properly valued
Classification – All transactions are classified to the proper account
Posting and summarization – All transactions are properly recorded in journals and in special and general ledgers.

sapfunctional

sap and sarbanes-oxley act