United States: The Impact of Regulatory Compliance Mandates on Business Process and IT Outsourcing

Last Updated: September 5 2005
Article by Stan Lepeak

Regulatory compliance mandates are becoming increasingly pervasive and onerous in western countries (see Figure 1). They have become a driving force in influencing affected organizations investments, areas of attention and activity, and in extreme cases strategic direction (i.e., going private in an attempt to avoid regulatory mandates). Business process regulation has become a new an uglier "BPR".

An affected large company, for example, could easily have total direct and indirect costs for Sarbanes-Oxley (SOX) compliance in excess of $10M annually. AMR Research estimates that affected organizations worldwide will spend $6B+ on SOX related activities in 2005, not counting actual audit fees, and will spend $80B+ over the next five years on compliance as a whole. On top of these costs, it is not uncommon for organizations to experience a doubling in the fees they pay their external auditors. And these numbers do not take into account the opportunity cost of compliance and the distraction it creates from other critical activities.

Figure 1 – Major Regulatory Mandates

DoD 5015.2, UK PRO: National standards on records management in the US and UK.

  • EU95/46, EU02/58: European Union privacy legislation.
  • Gramm-Leach Bliley Act (GLBA): Privacy of financial information.
  • Health Insurance Portability and Accountability Act (HIPAA): Privacy of patient information and healthcare records.
  • National Association of Security Dealers/NASD 3110: Written policies and procedures for review of correspondence with the public.
  • New Basel Capital Accord (Basel II): Capital assessment and reporting standards for global banking.
  • Sarbanes-Oxley Act: fiscal accountability and control environment integrity; various Europe versions are in place on a country by country basis.
  • SEC Rules 17a-3, 17a-4: Securities related records retention.
  • USA PATRIOT Act: Various anti-terrorism, surveillance and anti-money laundering dictates.

While organizations can debate the collective merit of these regulations, most are here to stay. While some, for example SOX, could potentially be scaled back – somewhat - the overall regulatory environment is not going to loosen significantly in the near term. Affected organizations must address these regulations as efficiently and effectively as possible.

Even more importantly, organizations must determine how to leverage the investments they are making to meet regulatory demands into gaining greater competitive gain. This could mean, for example, leveraging the greater visibility and transparency into financial processes that SOX investments deliver to focus more on financial analysis vs. transaction processing. Or a bank could become more aggressive with is loan policies based on insights into its risk profile derived from Basel II calculations. In this way, compliance investments also enable process and performance improvements efforts and are not just sunk cost of doing business.

One area where regulatory mandates are already having a major impact is around IT and business process outsourcing (ITO/BPO). Regulations, particularly SOX and various privacy regulations, complicate the outsourcing process. In the short term this has slowed and curtailed deals, particular finance and accounting BPO. Longer term, however, compliance requirements and burdens will drive more outsourcing as organizations seek third party support to better manage compliance costs and requirements.

The major problem relative to outsourcer and SOX is that while U.S. regulators (e.g., SEC, PCAOB/Public Company Accounting Oversight Board) have clarified that SOX requirements apply equally and as stringently to outsourced functions processes and well as those maintained internally, they have not clarified what organizations must to do show compliance. It is typically a case of – "it depends":

  • what has been outsourced,
  • where is the outsourcing being performed
  • what are the existing control environments
  • how affected are the involved processes by SOX stipulations.

This is not surprising given that SOX is a concept, not a rules, based regulation. Just as there is no standard checklist for overall SOX compliance, there are no exact guidance for how to address outsourced processes. While precedence and defined best practices will develop over time, organizations are struggling to initially define a SOX strategy and process to support outsourcing.

The result is that organizations are taking widely divergent approach to applying compliance requirements against outsourced processes and engagements. For example, two separate META Group studies conducted in 2004 found that nearly 25% of organizations were ignoring outsourced functions and processes in first year SOX efforts, a recipe for potential audit failures. Other organizations are much more aggressive.

One common misperception in the market is that existing outsourcing audit mechanisms, primarily the SAS 70 audit (see Figure 2), are always adequate for SOX compliance. The reality is that even a SAS 70 Type 2 audit may not prove enough for SOX in all cases. The SAS 70 standard was developed long before SOX regulations existed and was not designed to focus on the type of controls that SOX addresses. In addition, there have been no requirements for users to request an SAS 70 audit, and many have not. Also, one SAS 70 audit that historically could suffice for multiple clients of an outsourcer also may not be enough for SOX compliance.

The result is that there are more cases where aggressive/thorough clients are demanding additional controls and documentation beyond an SAS 70 Type 2 audit to enable what they estimate is "good enough" SOX compliance. In some cases, however, SAS 70 Type II audits are enough – it depends.

Figure 2 – SAS 70 and SOX Compliance

SAS (Statement on Auditing Standards) 70 is an international auditing standard developed by the American Institute of Certified Public Accountants for service organizations. An SAS 70 audit is the means through which an auditor examines a service organization’s or outsourcer’s control activities, particularly around IT and related processes. SAS 70 is based on SAS 55, "Consideration of Internal Control in a Financial Statement Audit," and on the COSO framework. There are Type 1 and Type 2 audits. Type 1 is a point-in-time/snapshot audit that focuses on general and application controls but does not include testing by auditors. A Type 2 audit occurs over a period of time (e.g., 6-12 months), focusing on general and operational controls during a life cycle, with auditors typically performing actual testing. A Type 2 is obviously more expensive as well as burdensome for the outsourcer. Only a CPA firm can perform an SAS 70 audit, and the Big Four audit firms, as well as the specialist firm SAS 70 Solutions (formerly part of Andersen), perform the bulk of the audits for G2000 organizations.

An added challenge organizations, particular finance and accounting operations, face with compliance requirements is that they are occurring in an era of aggressive and ongoing cost cutting. The goal of many organizations is to reduce F&A expenses to less than 1% of overall revenue. This goal is challenged by compliance requirements. A recent EquaTerra study found that improving the controls environment was the number one goal for organizations pursuing F&A transformation efforts. The number one goal in pursuing F&A BPO was cost reduction. While reducing costs and improving compliance and control capabilities may seem at odds, they are not if an organization can undertake BPO successfully.

BPO can help address an organization’s compliance needs in several ways.

  • Outsourcers may possess more efficient processes that require less controls and hence have a lower compliance costs.
  • Processes that have more automated and less manual controls are easier and cheaper to manage from a compliance standpoint.
  • Outsourcing service providers can perform much of the compliance legwork (e.g., control’s testing, documentation) and spread the cost of the resources to perform that work over multiple clients
  • Outsourcers with "best practice" process model can possess stronger embedded process controls.
  • Outsourcers can dedicate more compliance expertise & experience against controls management and optimization and spread those costs across multiple clients.
  • Outsourcers can gain more experience and capabilities with standardized (i.e., SAS 70) reporting.

Most outsourcers, however, are still struggling to get their compliance capabilities adequately in place along the lines defined above. Long term compliance efficiency and effectiveness will become a factor to help define BPO market leaders and will drive market consolidation. Organizations considering BPO or in existing arrangements must thoroughly vet their outsourcer’s compliance capabilities.

The following is a sample (and far from exhaustive) compliance checklist for organizations to use as a starting point in assessing compliance readiness and requirements in an outsourcing situation.

  • Compliance organization and internal audit represented on the buyer sourcing team
  • Corporate governance and risk management frameworks employed address and account for outsourcing requirements
  • Ownership assigned to address outsourcing governance and relationship management
  • Short-listed service provider’s Sarbanes capabilities and position understood
  • Service provider’s operations undergone SAS 70 audits
  • Geographic locations of potential service delivery centers known and compliance implications understood
  • Who covers the cost associated with compliance testing and SAS 70 audits agreed upon
  • Proposed contract calls out means to review, assess and account for future changes in the regulatory environment

Organizations must always remember, though, that they are ultimately liable for compliance requirements. This does not mean when the inevitable compliance meltdown involving outsourced processes occurs that the outsourcer won’t find itself in court. Organizations, however, must focus on the segmentation of compliance duties with an outsourcer to ensure they maintain ultimate control. This collaborative effort could divide the responsibilities along the following lines.

  • Document controls

>>

Service Provider

  • Test controls and review control designs

>>

Client/Service Provider

  • Design controls testing program

>>

Client/Service Provider

  • Sign-off on controls testing results

>>

Client

  • Suggest process improvement to improve compliance

>>

Service Provider

  • Approve process improvements

>>

Client

  • Define compliance, F&A policies & procedures

>>

Client

  • Define/own/manage risk assessment processes

>>

Client

  • Review/interpret responses to audit qualifications

>>

Client

  • Assist in performing remediation for audit qualifications

>>

Service Provider

Conclusion

Ultimately, successful BPO efforts can become a strong tool for organizations to improve compliance efforts efficiency and effectiveness. Outsourcing has the potential to improve the overall control’s environment and make compliance more sustainable. Most importantly, organizations can work with qualified outsourcer to leverage compliance investments for greater competitive gain. The process to marry compliance and outsourcing best practices is not an easy one, but one that it worth the effort.

About Stan Lepeak

Mr. Lepeak is a Managing Director at EquaTerra, the outsourcing and insourcing advisory firm. He leads EquaTerra’s EQuation Research, Training and Education practice area focused on global Information Technology and Business Process Outsourcing. He has followed the business and IT services and IT marketplaces for more than 15 years. He is a noted commentator and frequent speaker on business and IT professional services, business process outsourcing and transformation, organizational change, risk management, compliance, and underlying supporting technologies. Mr. Lepeak was also a Vice President and Research Lead at the META Group, a market research and advisory services firm. He led coverage of the business and IT services marketplaces and compliance research practice area, as was also Vice President of the Electronic Business Strategies service. He was also an executive at Elance, an enterprise software firm developing enterprise applications for sourcing and managing business and IT services, and Senior Vice President and Chief Research Officer at Ajunto, an IT software, services, and research firm. Mr. Lepeak has held various management positions in finance & accounting, operations and IT across several industries. He holds a degree from the University of Michigan.

About EquaTerra

EquaTerra is focused solely on providing global corporations with outsourcing and insourcing advisory, research and governance services that enable them to achieve service delivery excellence for their SG&A processes. EquaTerra's advisors average more than 20 years of industry, service provider and process experience with functional leadership in Finance & Accounting, Human Resources, Information Technology and Procurement. Our advisors have been involved in over 600 global business transformation, outsourcing and outsourcing governance projects.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

To print this article, all you need is to be registered on Mondaq.com.

Click to Login as an existing user or Register so you can print this article.

Authors
 
In association with
Related Topics
 
Related Articles
 
Related Video
Up-coming Events Search
Tools
Print
Font Size:
Translation
Channels
Mondaq on Twitter
 
Mondaq Free Registration
Gain access to Mondaq global archive of over 375,000 articles covering 200 countries with a personalised News Alert and automatic login on this device.
Mondaq News Alert (some suggested topics and region)
Select Topics
Registration (please scroll down to set your data preferences)

Mondaq Ltd requires you to register and provide information that personally identifies you, including your content preferences, for three primary purposes (full details of Mondaq’s use of your personal data can be found in our Privacy and Cookies Notice):

  • To allow you to personalize the Mondaq websites you are visiting to show content ("Content") relevant to your interests.
  • To enable features such as password reminder, news alerts, email a colleague, and linking from Mondaq (and its affiliate sites) to your website.
  • To produce demographic feedback for our content providers ("Contributors") who contribute Content for free for your use.

Mondaq hopes that our registered users will support us in maintaining our free to view business model by consenting to our use of your personal data as described below.

Mondaq has a "free to view" business model. Our services are paid for by Contributors in exchange for Mondaq providing them with access to information about who accesses their content. Once personal data is transferred to our Contributors they become a data controller of this personal data. They use it to measure the response that their articles are receiving, as a form of market research. They may also use it to provide Mondaq users with information about their products and services.

Details of each Contributor to which your personal data will be transferred is clearly stated within the Content that you access. For full details of how this Contributor will use your personal data, you should review the Contributor’s own Privacy Notice.

Please indicate your preference below:

Yes, I am happy to support Mondaq in maintaining its free to view business model by agreeing to allow Mondaq to share my personal data with Contributors whose Content I access
No, I do not want Mondaq to share my personal data with Contributors

Also please let us know whether you are happy to receive communications promoting products and services offered by Mondaq:

Yes, I am happy to received promotional communications from Mondaq
No, please do not send me promotional communications from Mondaq
Terms & Conditions

Mondaq.com (the Website) is owned and managed by Mondaq Ltd (Mondaq). Mondaq grants you a non-exclusive, revocable licence to access the Website and associated services, such as the Mondaq News Alerts (Services), subject to and in consideration of your compliance with the following terms and conditions of use (Terms). Your use of the Website and/or Services constitutes your agreement to the Terms. Mondaq may terminate your use of the Website and Services if you are in breach of these Terms or if Mondaq decides to terminate the licence granted hereunder for any reason whatsoever.

Use of www.mondaq.com

To Use Mondaq.com you must be: eighteen (18) years old or over; legally capable of entering into binding contracts; and not in any way prohibited by the applicable law to enter into these Terms in the jurisdiction which you are currently located.

You may use the Website as an unregistered user, however, you are required to register as a user if you wish to read the full text of the Content or to receive the Services.

You may not modify, publish, transmit, transfer or sell, reproduce, create derivative works from, distribute, perform, link, display, or in any way exploit any of the Content, in whole or in part, except as expressly permitted in these Terms or with the prior written consent of Mondaq. You may not use electronic or other means to extract details or information from the Content. Nor shall you extract information about users or Contributors in order to offer them any services or products.

In your use of the Website and/or Services you shall: comply with all applicable laws, regulations, directives and legislations which apply to your Use of the Website and/or Services in whatever country you are physically located including without limitation any and all consumer law, export control laws and regulations; provide to us true, correct and accurate information and promptly inform us in the event that any information that you have provided to us changes or becomes inaccurate; notify Mondaq immediately of any circumstances where you have reason to believe that any Intellectual Property Rights or any other rights of any third party may have been infringed; co-operate with reasonable security or other checks or requests for information made by Mondaq from time to time; and at all times be fully liable for the breach of any of these Terms by a third party using your login details to access the Website and/or Services

however, you shall not: do anything likely to impair, interfere with or damage or cause harm or distress to any persons, or the network; do anything that will infringe any Intellectual Property Rights or other rights of Mondaq or any third party; or use the Website, Services and/or Content otherwise than in accordance with these Terms; use any trade marks or service marks of Mondaq or the Contributors, or do anything which may be seen to take unfair advantage of the reputation and goodwill of Mondaq or the Contributors, or the Website, Services and/or Content.

Mondaq reserves the right, in its sole discretion, to take any action that it deems necessary and appropriate in the event it considers that there is a breach or threatened breach of the Terms.

Mondaq’s Rights and Obligations

Unless otherwise expressly set out to the contrary, nothing in these Terms shall serve to transfer from Mondaq to you, any Intellectual Property Rights owned by and/or licensed to Mondaq and all rights, title and interest in and to such Intellectual Property Rights will remain exclusively with Mondaq and/or its licensors.

Mondaq shall use its reasonable endeavours to make the Website and Services available to you at all times, but we cannot guarantee an uninterrupted and fault free service.

Mondaq reserves the right to make changes to the services and/or the Website or part thereof, from time to time, and we may add, remove, modify and/or vary any elements of features and functionalities of the Website or the services.

Mondaq also reserves the right from time to time to monitor your Use of the Website and/or services.

Disclaimer

The Content is general information only. It is not intended to constitute legal advice or seek to be the complete and comprehensive statement of the law, nor is it intended to address your specific requirements or provide advice on which reliance should be placed. Mondaq and/or its Contributors and other suppliers make no representations about the suitability of the information contained in the Content for any purpose. All Content provided "as is" without warranty of any kind. Mondaq and/or its Contributors and other suppliers hereby exclude and disclaim all representations, warranties or guarantees with regard to the Content, including all implied warranties and conditions of merchantability, fitness for a particular purpose, title and non-infringement. To the maximum extent permitted by law, Mondaq expressly excludes all representations, warranties, obligations, and liabilities arising out of or in connection with all Content. In no event shall Mondaq and/or its respective suppliers be liable for any special, indirect or consequential damages or any damages whatsoever resulting from loss of use, data or profits, whether in an action of contract, negligence or other tortious action, arising out of or in connection with the use of the Content or performance of Mondaq’s Services.

General

Mondaq may alter or amend these Terms by amending them on the Website. By continuing to Use the Services and/or the Website after such amendment, you will be deemed to have accepted any amendment to these Terms.

These Terms shall be governed by and construed in accordance with the laws of England and Wales and you irrevocably submit to the exclusive jurisdiction of the courts of England and Wales to settle any dispute which may arise out of or in connection with these Terms. If you live outside the United Kingdom, English law shall apply only to the extent that English law shall not deprive you of any legal protection accorded in accordance with the law of the place where you are habitually resident ("Local Law"). In the event English law deprives you of any legal protection which is accorded to you under Local Law, then these terms shall be governed by Local Law and any dispute or claim arising out of or in connection with these Terms shall be subject to the non-exclusive jurisdiction of the courts where you are habitually resident.

You may print and keep a copy of these Terms, which form the entire agreement between you and Mondaq and supersede any other communications or advertising in respect of the Service and/or the Website.

No delay in exercising or non-exercise by you and/or Mondaq of any of its rights under or in connection with these Terms shall operate as a waiver or release of each of your or Mondaq’s right. Rather, any such waiver or release must be specifically granted in writing signed by the party granting it.

If any part of these Terms is held unenforceable, that part shall be enforced to the maximum extent permissible so as to give effect to the intent of the parties, and the Terms shall continue in full force and effect.

Mondaq shall not incur any liability to you on account of any loss or damage resulting from any delay or failure to perform all or any part of these Terms if such delay or failure is caused, in whole or in part, by events, occurrences, or causes beyond the control of Mondaq. Such events, occurrences or causes will include, without limitation, acts of God, strikes, lockouts, server and network failure, riots, acts of war, earthquakes, fire and explosions.

By clicking Register you state you have read and agree to our Terms and Conditions