'Sarbanes-Oxley Act’ Raises the Bar for Not-For-Profits,
By John Dee

At first glance, The Sarbanes-Oxley Act passed by Congress in 2002 only affects publicly-traded companies. It establishes measures to help restore the public’s confidence in corporate financial reporting and compliance with applicable laws and regulations. It also holds corporate officers personally accountable for their representation of the corporation to the outside world.

Closer study, however, reveals that The Sarbanes-Oxley Act is also having an effect on private companies and not-for-profits, and that forward looking associations are using the legislation as an opportunity to improve their organizations and become even more responsive to member needs.

THE EFFECT ON NOT-FOR-PROFITS
While the Act specifically targets publicly-traded companies, attorneys and advisors are recommending to their clients in the private and not-for-profit sectors that they comply with Sarbanes-Oxley. In fact, a recent survey by Robert Half Management Services found that nearly 60 percent of CFOs in privately-held companies are already implementing new procedures based on Sarbanes-Oxley regulations.

Why the rush to comply with legislation that doesn’t even target you?
Good business sense, that’s why.

In the year since the legislation was passed, compliance with Sarbanes-Oxley has become viewed as “best practice.” Not-for-profit board members are reasoning, “If that level of transparency and scrutiny of financial statements is expected in the corporate world, then it should be standard operating procedure in the private and not-for-profit sectors as well.”

There’s even some thought that states will begin to pass similar legislation focused on not-for-profits. Associations that make an effort today to improve the transparency of financial reporting and demonstrate compliance with applicable regulations will find it easier to comply with possible new state laws in the future.

AREAS OF IMPACT
Compliance with Sarbanes-Oxley involves five areas within an association. A brief description of each follows.

Internal Controls
Controls are actually a process affected by an organization’s board of directors and management to provide reasonable assurance that objectives are being achieved in the efficiency and effectiveness of operations, reliability of financial reporting, and compliance with laws and regulations.* Management must document and monitor the internal controls and procedures, and provide for independent review and auditor attestation on a periodic basis.

Associations that are too small to develop their own set of controls and procedures can work with a third party, such as an association management company, to obtain pre-developed internal controls. The third party should itself be accredited to demonstrate its qualifications. Both the American Society of Association Executives (ASAE) and the International Association of Association Management Companies (IAAMC) offer accreditation programs for association management companies.

Auditor Independence
Conflict is avoided by prohibiting an auditor from performing non-audit services for the association (i.e., bookkeeping, IT design and implementation, etc.) Further, the audit firm partner serving the association should be rotated every five years and should report directly to the audit committee of the board. This level of independence can be expensive for an association—both in dollars and in lost advice from an auditor who also serves as an advisor.

Audit Committee
The board’s audit committee serves as the primary contact with the auditor, and may not include members of the association’s management. To maintain its integrity, it must include at least one “financial expert” and none of its members can be compensated by the association for activities outside of the scope of the committee (e.g., banker used by the association.) For added insurance, audit committees may choose to seek their “financial expert” from outside the association’s membership.

CEO and CFO Certification
In addition to making sure the association’s internal controls are being implemented and monitored, officers also make sure violations are reported to the auditor and the audit committee. Officers also review the annual report and certify that it contains no material misstatements or omissions.

Disclosure
Sarbanes-Oxley requires that material changes to the financial position of a publicly-traded company must be disclosed to the shareholders on a “rapid and current basis.” While disclosure is less of an issue in the private and not-for-profit sectors, it presents an opportunity for an association by decreasing the risk of material operational and financial problems. It also underscores the need for a code of ethics for officers and the importance of real-time information systems. In the absence of shareholders, an association has to decide which stakeholders it is disclosing to—board of directors, audit committee, membership?

SUMMARY
Compliance with The Sarbanes-Oxley Act is quickly becoming a ‘best practice’ in the not-for-profit sector. Many associations are using compliance as a method of improving their organizations and becoming even more responsive to their members’ needs.

They view compliance as standard operating procedure and are supportive of the changes needed for independent review of internal controls, auditor and audit committee independence, and disclosure.

John Dee, CPA is the Chief Financial Officer and General Manager of Bostrom Corporation.

Footnote
* Committee of Sponsoring Organizations of the Treadway Commission.