Reaching Full Compliance with Sarbanes-Oxley

-RevenueRecognition.com

RevRec.com:
How has the need to comply with the mandates in Sarbanes-Oxley (SOx) affected S1’s best practices, changed internal controls, and otherwise impacted the way in which you manage the financial (and particularly revenue recognition and reporting) functions of your company?

Matt Hale:
Well, the impact is obviously extensive and significant, something I think most public companies are feeling quite strongly. After the Act was first passed, our initial focus was on understanding the individual elements as closely as possible, working with our audit firm and also external SEC counsel to gain the knowledge we needed. As soon as we could, we then implemented an internal initiative to make sure that everyone who needs to, is clear about what Sarbanes-Oxley means to the way we conduct business. We’ve accomplished a lot so far, but we will continue to have items in process for some time, as we interpret the guidance further and in greater detail.

RevRec.com:
Whom did you spider the information out to?

Matt Hale:
The Audit Committee, Management Team, and the Senior Business Unit Leaders form the core group, led by Counsel and our Internal Audit lead, who serves as an important resource. A year and a half ago, we hired the internal audit leader who implemented a serious and stringent (internal audit) process, giving us a significant head start on complying with Sarbanes-Oxley. He is already in a leadership role, acting as an anchor for process control changes.

RevRec.com:
So now that the education process has taken hold, what changes are you making to internal controls to meet SOx’ demands?

Matt Hale:
Previously, even though we had good, tight internal controls in place, we hadn’t done the best job of documenting them. So we’re busy right now doing that, documenting all of the controls that constitute our system, and conducting a gap analysis to identify areas for change. Fully written policies, processes of review, closing procedures…and another critical process: a quarterly periodic review for the remote business units. S1 has multiple business units in both its core and non-core operations, domestically and internationally. I spearhead the new process and conduct onsite or headquarters-based reviews. This is structured as a one-day analysis of detailed operational and financial results. Each business unit leader has to certify their own financial reports, providing a “link chain” of accountability and certification. With better documentation, improved education, amended internal controls, and improved general business procedures, we’ve achieved some key milestones already.

So, what’s still open? Completing the full documentation of our processes, policies and procedures. And we will continue to execute against the quarterly certification and review requirements.

RevRec.com:
What about disclosure needs – how have you handled that part of the new requirements?

Matt Hale:
For quarterly SEC filings, we determined that we needed to broaden the number of people involved, so we expanded it three-fold. Now it includes all of the business unit managers and their dedicated finance people. Individually, each person receives a draft of the periodic report and provides feedback within the context of reviewing it for adequacy of disclosure and any potential omissions. Responses are provided back to me in a separate written report. While this added time to the closing and reporting process, fortunately the SEC has extended the time before the new filing and reporting deadlines go into effect. We expect to have the process baked into our normal close over 2003, and be ready to meet the accelerated reporting timelines that go into effect after 2003.

There are other measures that must be taken to accelerate the financial reporting and certification process for S1. For example, we have to make it possible to reduce the time it takes the accountants to close the books to better meet the filing deadlines. That requires an investment in systems that will ensure a tighter close, while not giving up accuracy and quality. We already have an ERP system , but the Company has been very acquisitive over the past three years, and the system wasn’t rolled out everywhere. In addition, the implementation doesn’t fit our current go-to-market structure, and so our existing infrastructure is not necessarily the best fit for present operational realities.

I define our current needs as being for solutions that enable better customer management, allow for tighter controls, and manage revenue recognition for us. To meet those requirements we’ve started three critical initiatives: evaluating a system that would provide the ability to manage all aspects of the customer lifecycle, including order management and customer care, and all associated revenue recognition; re-implementing the ERP system; and installing a simpler accounting package for international locations with multicurrency needs. Upgrading the existing infrastructure is a key factor in using a more formalized process, and accelerating the processes we need to use to ensure we can meet these more aggressive reporting deadlines. I think we’ll be able to do that by the end of 2003, with everything in place.

RevRec.com:
Apart from evaluating and in some cases re-engineering best practices and systems infrastructure, what other elements of SOx have your attention right now?

Matt Hale:
Part of working our way through Sarbanes-Oxley to reach full compliance is establishing a clear path of communication, and a process whereby whistleblowers can safely and quickly get access to the Audit Committee. Fully meeting this requirement of the Act is a serious responsibility. But even more important than this specific process, is examining our current ethics policy. There will now be an annual “tone from the top” message from S1’s CEO and the Chairman of the Board – a joint message - discussing good business practices and appropriate ethics, that’s intended to lend further power to the regular distribution of the corporate policy on that subject. The first one will be in January, and will be an important first step.

RevRec.com:
In all of this, your relationship with the CEO must have changed.

Matt Hale:
Absolutely. The existence of Sarbanes-Oxley has provided a different level of communication and discourse around any business topic. SOx creates a new foundation for evaluating judgment decisions. This is a positive change. There’s a more tangible foundation for discussion, and it’s extremely productive. My work with the CEO has been enhanced and strengthened through this.

RevRec.com:
Compare the “before and after” of your role as a CFO.

Matt Hale:
Before Sarbanes-Oxley, my focus was split fairly evenly between operations, and finance. Now, with the implementation issues and changes in the business environment, I have a redirected concentration on financial issues so that I can guarantee the necessary changes are on track. I’m delegating differently now, to my Controller, the Internal Auditor, Legal Counsel—I’ve asked them to step up to a higher role and affect change. In turn I rely on them more.

RevRec.com:
What advice would you give to a fellow CFO right now?

Matt Hale:
Every company must have a good and realistic assessment of where they are at the present time. Each variable, and there are many, in their operational and financial processes has the potential to completely alter the way they conduct business under Sarbanes-Oxley. If they want to reach compliance with the new corporate governance, they have to invest in due diligence right away. They can’t move forward with confidence if they don’t examine all of their processes, procedures and controls with an eye for the very detailed.

RevRec.com:
So when you’re not in the office tackling life as a CFO, where can we find you?

Matt Hale:
That’s easy. I can be found on a golf course. I also collect wine, so that’s the other possibility – selecting a case or two of something new.

S1 (Nasdaq: SONE) is a leading global provider to approximately 4,000 banks, credit unions, insurance providers, and investment firms of enterprise software solutions that create one view of customers across multiple channels, applications and segments. The company’s global headquarters are in Atlanta, GA. Additional information is available at www.s1.com