SARBANES-OXLEY COMPLIANCE Q&A  
 
If you've been assigned the task of researching Sarbanes-Oxley Act compliance resources, this section of the In Touch website is intended to provide some guidance. Although we strongly recommend that you consult with your attorneys and auditors about what is needed in your particular situation, we do think we can provide some useful perspectives around the handful of questions that appear to be remarkably universal.

 
 

 
 

We believe In Touch is uniquely qualified to provide objective, knowledgeable answers to your questions. We have been in the employee feedback business for over 15 years and we have learned from having worked with hundreds of companies what works and what doesn't. It's not coincidental that In Touch's pioneering innovations have been featured in business publications that range from The Wall Street Journal and The Financial Times to trade journals that include HR Magazine, Workforce Magazine, The Corporate Board and the American Corporate Counsel Association Docket. Many of the articles that have appeared in these and other publications are posted in the "News & Articles" section of our website, and if you haven't already done so, you might want to read some of them.

In addition, there are several other aspects of In Touch that position us as the quality leader in the "hotline" industry. Technologically, we offer the most advanced automated systems available, most notably the confidential and anonymous, two-way communication approach offered by our company's proprietary TouchBack™ system. In addition, our St. Louis based call center is staffed with the most skilled and dedicated employees to be found in the call center industry. Our interviewers are all credentialed at a master's level or above and their employee turnover rate averages far below the industry standard. In fact, ours is the only hotline call center in the country to have received external certification. It's absolutely critical that when an anxious employee summons the courage to make a difficult call, a skilled professional with the experience, training and empathy to deal with sensitive issues will answer them. No other hotline service can come close to providing our level of expertise.

In Touch is the only resource available that can provide a full range of feedback options. Whether you want to use a system that is automated or live and supplement that system with e-mail, fax and/or TTY, we can supply it. We are one of very few companies to have implemented and operated global feedback systems that include on-demand translation services. And as our three best-practices recognitions attest, we do all of this extremely well.

Here are some of the questions that we're being asked most frequently. If you have others you think we should add to the list, please e-mail them to us at info@getintouch.com.

1. Section 301 of the Sarbanes-Oxley Act requires that audit committees of publicly held corporations shall establish procedures for "the confidential, anonymous submission by employees" of complaints regarding accounting, internal accounting controls or auditing matters." What does that mean?

Our strict interpretation of this requirement is that audit committees must put a mechanism in place that both assures employees of confidentiality and anonymity and that directs any concerns about the three specified issues of accounting, internal accounting controls or auditing matters to one or more members of that Board group.
The first related question is whether it's possible to have an internally administered system that meets the "confidential, anonymous" test. Theoretically, it might be possible to develop an internal system that is defensible as confidential and anonymous, but for that argument to prevail, there must be no way for the company to ID phone numbers, trace e-mail, recognize voices or analyze hand-writing. If there is a risk of any of these being called into question, the system will lack credibility and if a problem goes unreported, the Board will have an extremely difficult time justifying the decision not to have used an external resource.
Why wouldn't a company use an external hotline resource? There really isn't any good reason not to, and while the law doesn't formally prescribe an external system, it's arguably the spirit of the legislation. We suggest that companies and their Boards would be best served by utilizing the services of a company such as In Touch that can maximize the confidence of callers that they can truly remain confidential and anonymous, if they so choose.
The second issue is whether employees must be provided with direct access to Audit Committee members. While this is arguably also the spirit of the law, the letter of it is mitigated by materiality and topicality of the messages sent by employees. It's also worth noting the Act is silent on the possibility of management implementing a parallel system for its own benefit that might be similar or even broader in scope than the Board mandated mechanism. Such a system would strengthen the company's ethical orientation, a quality that is contemplated by other sections of the Act.
Indeed, what sounds at first glance to be a relatively simple requirement, does have some hidden complexities.

2. What type of feedback system should a company use?

As we work with companies on the design of feedback systems, we emphasize three strategic dimensions that need to be considered: the scope of the feedback, the coverage of the feedback and the contact mechanism(s) for the feedback.
By scope, we mean the feedback topics the system will be designed to encourage. If you click on the "Sample Messages" option on this website, you will see what we call the "Feedback Universe." That universe is divided into three spheres of management concern: Regulatory Issues, Human Issues and Organizational Issues. Many feedback programs focus on the inner two rings and exclude the third. We believe that is a decision worthy of more than cursory discussion and we can provide some compelling rationales for placing no restrictions on what employees can discuss on the company's hotline. In fact, both the ACCA Docket and Corporate Board articles in the "News & Articles" section of our website expand upon this topic. While the specific Sarbanes-Oxley requirements seem to be limited to the Regulatory sphere, "doing the minimum" is a questionable strategy in today's business environment.
By coverage, we mean the inclusiveness of the system. In terms of employees, the two major groups are domestic and international. There is nothing in Sarbanes-Oxley which excludes employees located outside the United States, and we believe that multinational companies need to have a program that is global in scope. Beyond employees, there are vendors and customers. A model ethics program would extend a feedback option to those stakeholders as well. Lastly, there is the issue of language. What accommodations should the system make for users who do not speak English?
By mechanism, we mean the communication tools that are to be utilized to enable the exchange of "confidential, anonymous" information between the company and the coverage group. The instruments that can be used for communicating include telephone, fax, e-mail, TTY and postal service. In the case of telephone, an automated answering system and/or a live-staffed call center can collect information. In our opinion, it is important that both automated and live systems provide the ability to communicate back to the caller without compromising the system's confidentiality and anonymity. This is typically done via means of a randomly generated case code. In terms of e-mail systems, the options include inputting the information at an independent website and/or using a company's Intranet system as a primary or secondary collection tool.
System selection is a topic that is more complex than it might appear on the surface. With that in mind, we have provided a worksheet at the end of this Q & A which is designed to help put some structure to your decision making process.

3. What kind of mechanism(s) should we feature in our feedback system?


When companies initially contact us, they tend to have a bias towards one specific type of feedback tool. Most frequently, they indicate preference for having a live interviewer process employee messages. The thinking is that a skilled interviewer will be able to coax more insightful feedback than would be received via an automated or e-mail centered system. In fact, there is no research to support that conclusion, and in our own anecdotal experience, the content of messages obtained on an automated system is frequently superior in the utility of the data.

In Touch is one of few companies to offer both live and automated systems, and we charge the same price for either, so the choice is entirely yours to make. And if your company is willing to make a one-time investment in the specific equipment required, we can even provide a combination of the two. Our suggestion is that before coming to any conclusions, talk with some representative employees and see what their preference might be.

Regardless of whether the system centers around a live or automated approach, it should provide the means for the company to communicate back to the caller while at the same time assuring confidentiality and anonymity. That is accomplished via the assignment of a randomly generated number that enables the caller to check back at a specified time and receive a status report and/or request for additional information. Most high-end system vendors, including In Touch, offer such two-way capability.

We believe that e-mail should be a supplemental rather than a primary feedback option. The strongest rationale is that in most organizations, not every employee has access to a computer. Equal access is a very important criterion. Additionally, employees tend to have concerns about the confidentiality of data that is sent over the company's computers. It's definitely a mixed message to tell employees in one breath that their computer activities are monitored and backed up and in the next breath that they should embrace it as a "confidential, anonymous" communication tool.

4. How can our company provide access for employees located in foreign countries?

The two best ways to provide access for employees located overseas to a US-based compliance system are toll-free lines and collect calling. Both are relatively straightforward. It can take several months in some places to succeed in obtaining telephone numbers assigned and there are a handful of areas from which service isn't available, but in general, this is the recommended way to include overseas employees in a feedback program.

Cultural barriers do tend to limit the active participation of international employees in a compliance program, but it is possible to increase utilization via training and the user friendliness of the system. This challenge all but dictates the use of a live call-taker system, which provides a way for conversations to be translated by a native-speaker. This is accomplished by conferencing-in a translator from one of several service providers who offer exactly this kind of on-demand support.

5. What is the routing process for calls received through the In Touch system?

If there's one issue relating to the Sarbanes-Oxley Act that is proving the most controversial, it relates to the type of messages that are to be sent to the Audit Committee and the process for getting them there. The majority of companies seem to take the position that they would prefer to err on the side of caution. Their interpretation is that if and when an employee indicates the desire for a message to go directly to the Audit Committee, that's where it should go. The "screening process" for determining the caller's intent is to either have the live interviewer ask the question or have the caller make a conscious selection in an automated system. A few have asked us to assess the importance of calls we receive and to route them based on our staff's judgment. For reasons of liability, we are reluctant to do so without proper indemnification.

On the other extreme, there are those who believe routing decisions can be made by someone inside the company other than a member of management (e.g. an internal auditor or Legal Department associate.) Although such a procedure may meet the letter of the law, we don't believe it is consistent with the spirit. And when the day is done, image counts for a lot when it comes to Sarbanes-Oxley. As suggested earlier, those companies that want only to do the minimum risk their reputations if serious problems occur.

6. What criteria should be used to evaluate a hotline provider?

If you've typed the phrase "Sarbanes-Oxley" into a search engine such as Google, you’ve probably noticed that there are a dozen or more companies advertising their compliance/hotline services. Trying to sort through the maze of service providers can be a daunting challenge, but there are a few questions that can quickly help to separate the veteran companies in the feedback industry from those that are exploiting this windfall opportunity. Some of the questions are obvious ones, but to the extent it's helpful to have some quick screening criteria, the following questions are those that we think are the most relevant and important:

1. How long have you been providing "confidential, anonymous" reporting systems?
2. Who are some of your clients?
3. How many types of systems do you provide?
4. Do you have a call center and, if so, does it truly operate 24/7?
5. What are the minimum qualifications of your call center staff and what is your annual interviewer turnover rate?
6. What criteria do you use to evaluate your service levels and how have you performed against those criteria?
7. What kind of reports do you provide to your clients and who prepares them?
8. Has your company been profitable over the past three years and to what degree is your balance sheet leveraged?
9. What is your client retention rate?

We would be pleased to respond to any and all of these questions and we look forward to your comments.

 

Our comprehensive, award-winning array of services can be utilized as is or customized to fit your specific needs.
Management Communication
Systems, Inc. & InTouch

3100 West Lake Street, Suite 430
Minneapolis, MN 55416 U.S.A.

Phone:
 612.926.7988
 Fax:
 612.926.4140