Business IT Alignment News and Analysis
August 13, 2007
By Jennifer Zaino
Becoming compliant with Sarbox takes its toll and delivers benefits, too—even in Europe.
Sarbanes Oxley has a long reach. Multinational food retailer Delhaize Group, which is listed both on the Brussels and New York Stock Exchange, adheres to the requirements. As a foreign issuer, it became compliant at the end of last year.
It made it, but its Belgian operating unit is dead set on not achieving compliancy through the same resource-hogging and time-sucking manual processes the second time around. “We succeeded in 2006 but that was definitely everything except painless,” said Thierry Claes, Finance Processes & Systems Manager.
The process consumed the full-time attention of approximately 40 staff members on both the business and IT side. The Belgian operating unit, as well as the rest of the Delhaize group, used tools such as Excel, Word and Visio to develop flow charts documenting every step of each detailed process, and to analyze every IT application link between the business process and IT controls, as well as to test the controls and document the results.
“Year-One compliance costs for SOX in Belgium we decided were not feasible for the coming years, so we are automating that. We’re now in the automation phase of this process for Sox. It’s really based on the theory of going from project to process,” said Claes.
Part of the problem going into its Year-One compliance project, was the organization postponed working towards compliancy for as long as possible so as not to divert resources and funds away from other short-term business initiatives. Also, “everyone imagined our processes were very well known and under control,” he said, but from the documentation side, things were not in as good shape as they might have seemed. “There’s always a difference between what you expect your process to be and what it is in reality.”
While the effort was no cakewalk, it did lead to a realization on everyone’s part that having stronger internal controls would prove an advantage in the long run; adding to the goal of developing a process-centric view running the company. The compliance process helped the company realize where there were bottlenecks in processes, duplicate activities, and other complications.
It also helped formalize the relationships between IT and business partners. “You can’t analyze a process without talking to IT, and before SOX there was a kind of segregation between IT and business people,” he said. Now, before developing something, clear business requirements are written down and IT is able to bring greater order and efficiency to its role as a service provider. “Limiting (expectation gaps) between the two groups was one of the major achievements from Sox,” Claes said.
Delhaize’s Belgian operations are now deploying MEGA International’s Governance, Risk and Control Platform to describe and map all of its risks and controls in order to establish its compliance process. “As a process we needed a tool that can really integrate all the components of Sox, mainly process controls and testing,” said Claes.
With MEGA there is now a single automated process to describe all risks and controls, maintain accurate compliance data, and communicate critical information across various departments. Delhaize Group began working with the tool at the beginning of this year and is now in the process of documenting and writing the controls and putting in place the workflows for testing. Already, the group has been able to go from eight full-time managers on the business side managing Sox compliance to two.
While many on this side of the Atlantic have griped about the costs and pain of SOX, Claes actually seems glad Delhaize wound up being impacted by it, too. “I’m not sure that in Belgium that we would have been able to buy this kind of tool and go to business improvement and process improvement if we hadn’t had the SOX rule and the pressure from the eyes of the whole world on us,” he said. “The combination of Sarbox and the process management initiatives we now have going will give us more control on our processes and the performance improvement will be much higher.”
Back