TrendsTalk: Sarbanes-Oxley and your Supplier Evaluation Process

September 23, 2004

2

Sarbanes-Oxley - a requirement that is also an opportunity

“Most observers would agree that the Sarbanes-Oxley Act (SOA) is the single most important piece of legislation affecting corporate governance, financial disclosure and the practice of public accounting since the US securities laws of the early 1930s.”

PWC

“Companies that just see this as a reporting requirement will lose out. Companies that put together a supply chain risk management process with their partners will extract the biggest gain from their efforts.”

AMR Research

“…There is a hidden benefit in Sarbanes-Oxley, these new internal controls help run businesses more effectively…such as avoiding overspending, operational failures, fraud and litigation.”

Edward Nusbaum, CEO, Grant Thornton

Chief Executive, May 2003

3

Sarbanes-Oxley has redefined how we do business today

• Legal and regulatory focus on internal controls, including timely ability to access and analyze information

• Established disclosure controls and procedures

• Certify completeness and quality of disclosure and procedures

• Publicly file Internal Control report

• Real time disclosure obligations

• Accelerated filing deadlines

• New and increased criminal penalties

• New and expanded role of the audit committee

• Increased SEC review

Good Internal Controls Is No Longer Best Practice …It Is The Law!

4

Compliance is challenged during the supplier registration and evaluation process

• The manual qualification process is time consuming

• Inconsistent or incorrect supplier data leads to inaccurate reporting

• Lack of third party information to validate supply-based decisions

• Inability to uncover the risk associated with potential or existing suppliers

5

Another huge challenge for companies is how quickly businesses change today

• In the next 60 minutes …

– 251 businesses will have a suit, lien or judgment filed against them

– 183 business telephone numbers will change or be disconnected

– 43 business addresses will change

– 36 directorship (CEO, CFO, etc.) changes will occur

– 33 new businesses will open their doors

– 8 companies will change their names

– 7 businesses will file for bankruptcy

• So in a year…

– 21% of CEO’s will change

– 20% of all addresses change

– 18% of telephone numbers will change

– 17% of business names will change

6

A recent survey echoes the challenges supply management organizations face in conforming with the Sarbanes-Oxley Act

34%

34%

34%

34%

31%

31%

28%

24%

24%

14%

7%

0% 10% 20% 30% 40% 50%

Accurate and timely visibility into spending

Control of outsourced supply management activities(e.g., outsourcing of certain spending categories, etc.)

Accurate and timely visibility into inventories

Tracking and managing supplier conformance toControl of outsourced manufacturing

Locating of supplier contracts

Control of outsourced inventories

Analysis and reporting of spending on a quarterly basis

Tracking and managing supplier conformance to contract prices(e.g., prices, volume discounts, rebates)

Calculating and controlling logistics/freight costs

Control of travel and entertainment (T&E) expenditures

34%

34%

34%

34%

31%

31%

28%

24%

24%

14%

7%

0% 10% 20% 30% 40% 50%

34%

34%

34%

34%

31%

31%

28%

24%

24%

14%

7%

0% 10% 20% 30% 40% 50%

non-price contract terms (e.g., service levels)

34%

34%

34%

34%

31%

31%

28%

24%

24%

14%

7%

0% 10% 20% 30% 40% 50%

Accurate and timely visibility into spending

Control of outsourced supply management activities(e.g., outsourcing of certain spending categories, etc.)

Accurate and timely visibility into inventories

Tracking and managing supplier conformance toControl of outsourced manufacturing

Locating of supplier contracts

Control of outsourced inventories

Analysis and reporting of spending on a quarterly basis

Tracking and managing supplier conformance to contract prices(e.g., prices, volume discounts, rebates)

Calculating and controlling logistics/freight costs

Control of travel and entertainment (T&E) expenditures

34%

34%

34%

34%

31%

31%

28%

24%

24%

14%

7%

0% 10% 20% 30% 40% 50%

34%

34%

34%

34%

31%

31%

28%

24%

24%

14%

7%

0% 10% 20% 30% 40% 50%

non-price contract terms (e.g., service levels)

Source: Aberdeen Group, January 2004

7

The survey also asked what key business application strategies companies will use to address Sarbanes-Oxley Act requirements

10%

17%

31%

41%

0% 10% 20% 30% 40% 50%

Upgrade to newer release of existingERP/supply management system

Consolidate ERP systems

Evaluate new analytics andperformance measurement

Identify existing features and functionsof supply management systems

Source: Aberdeen Group, January 2004

8

To have the confidence to meet the Sarbanes-Oxley requirements, procurement professionals are adopting some best practices:

• Ensuring the quality of supplier information

• Establishing standard controls and procedures for supplier registration process

• Qualifying suppliers better

• Understanding the risk associated with these suppliers

• Monitoring the stability of critical suppliers that can affect financial condition

• Ensuring contract terms and conditions

9

Compliance starts with quality information – we define quality by the accuracy, completeness, timeliness and consistency of the information

Accuracy

Completeness

Timeliness

+

Cross-Border Consistency

Decisions

Identify high-risk suppliers

Reduce exposure to supplier failure

Manage total risk exposure

Assess risk more

frequently

Exploit untapped opportunities with existing suppliers

Ensure corporate and regulatory compliance

Decisions

Grow and manage

your diverse suppliers

Quality of Information?

10

Our process of collecting and enhancing data is called DUNSRightTM and consists of Quality Assurance plus five quality drivers

GlobalData

Collection1

EntityMatching

2

D-U-N-SNumber®

3

CorporateLinkage

4

PredictiveIndicators

5

D&B Global

Database

Quality Information

Quality Assurance

11

We collect the most complete data about suppliers and with one million daily updates to our database, you can be confident of the real time information

Web Sources and Directories• 4.7 million URLs• Updates from 30 million+ domains• 90,000+ customers providing online updates

D&B Global Database

• Over 85 million businesses

• Over 200 countries

Over 1 Million Daily Updates

Public Records and Government Registries• 134 million• Suits, liens, judgments and bankruptcy filings• Business registrations

Payment and Financial Data• 580 million trade records updated annually• 100% coverage of Public company financials• 97% of all fin statements are privately held co’s

Direct Investigations, News and Media• 115+ million phone calls annually to businesses• Top News providers• Merger/Acquisitions

D&B D-U-N-S® Number

12

Our D-U-N-S Number is a unique means of identifying and tracking a business globally so you can authenticate who you are doing business with

GlobalData

Collection1

EntityMatching

2

D-U-N-SNumber

3

CorporateLinkage

4

PredictiveIndicators

5Uses statistical analysis to identify and manage the risk exposure in a supplier portfolio

Aggregates data from thousands of sources providing the most comprehensive database on suppliers in over 200 countries

Eliminates duplication of suppliers within a supply

base, providing increased leverage and an accurate view of global and diverse suppliers

Unique means of identifying and tracking the business globally through any changes it goes through

Builds corporate families to provide a view of total supplier risk and leverage opportunity

Quality Assurance

13

Our Predictive Indicators indicate the likelihood of a supplier to perform in a specific way in the future which enables SOX real time disclosures

GlobalData

Collection1

EntityMatching

2

D-U-N-SNumber

3

CorporateLinkage

4

PredictiveIndicators

5Uses statistical analysis to identify and manage the risk exposure in a supplier portfolio

Aggregates data from thousands of sources providing the most comprehensive database on suppliers in over 200 countries

Eliminates duplication of suppliers within a supply

base, providing increased leverage and an accurate view of global and diverse suppliers

Unique means of identifying and tracking the business globally through any changes it goes through

Builds corporate families to provide a view of total supplier risk and leverage opportunity

Quality Assurance

14

Many companies are establishing processes and controls for supplier registration to ensure timely ability to access and analyze information, such as:

• Company search by name, identifier, location, etc

• Company identification and contact information

• Demographics information

• Financial information and references

• Supplier diversity information

• Insurance, federal tax and certification information

• Tier 2 supplier information

15

By automating it over the Web so they can authenticate suppliers quickly

16

Companies can request their suppliers to pre-qualify themselves by searching by their DUNS Number to get their own D&B information

17

Or companies can quickly access supplier information by searching by various parameters, such as ‘all suppliers in their database’

18

Upon getting results, companies can easily review the verified details surrounding an individual supplier

19

Next companies request suppliers to fill in all relevant company information…

20

Such as demographic information…

21

Company contract information…

22

Financial information…

23

As well as bank reference information – all this information is particularly relevant to assessing the material impact of a supplier on your business

24

Additionally, companies can pre-qualify based on supplier diversity information

25

Once a supplier has completed the registration process, it receives their own Supplier Qualifier Report, which helps qualify based on years in business…

26

…by their assets and liabilities…

27

...or by the level of risk associated with that supplier - our proprietary score predicts the likelihood of that supplier to go out of business within 12 months

Scores of 7, 8, 9 considered high risk

28

This helps companies avoid supply chain disruption by identifying critical suppliers with high scores, which can impact their financial condition or operations

Score or 7, 8, 9 considered

high risk

29

Another best practice is reviewing supplier relationships closely – for example, these suppliers appear to be separate and unrelated companies…

Clayco Inc. Ceramico, Inc. Glazetech, Inc.

Fictional example

In your systems these companies look like

separate business entities

30

But in reality are actually part of the same corporate family

Clayco Inc. Ceramico, Inc. Glazetech, Inc.

CCGCorp

Fictional example

CCG, a foreign-owned company, actually controls

three of your suppliers. How much do you really

know about CCG?

31

This allows them to identify how much they are spending with those suppliers to understand the total material impact to their business

Clayco Inc.$500K Spend Ceramico, Inc. Glazetech, Inc.

Glazetech - France$500K Spend

$1.5MM total global spend with CCG CorpCCGCorp

Ceramico,Ltd.

Glazetech - France.$500K Spend

Ceramico,Corp.

Fictional example

32

Understanding Corporate Linkage is even more important given the continual change in ownership from all the mergers and acquisitions today

33

Many companies are also reviewing the supplier/ customer relationship and how they are conducting business with them and how much they are spending

Company C

Company D

Company A

Company E

Company F

Company H

Company I

Company K

Company J

Company G

Company B

Fictional example

34

Similarly, many companies are even identifying potential conflict of interest between suppliers and employees

• Determine if employees, or their cohabitating family members, are also acting as suppliers for their company

• Understand which employees, or their cohabitating family members, are operating businesses that could potentially become suppliers of their company

35

Lastly, companies are also tracking the terms and conditions of their individual supplier contracts since they can have material impact

• Effectively monitors whether a supplier adheres to contractual terms and conditions including: • Rebates• Price discounts based on volume• SLA performance

• Ensures companies realize their negotiated savings or meet their cost reduction goals

36

DUNSRight is an established process that helps you comply with key sections of Sarbanes-Oxley

GlobalData

Collection1

EntityMatching

2

D-U-N-SNumber

3

CorporateLinkage

4

PredictiveIndicators

5Scores predicting supplier risk

Material impact on your financial condition

Real time disclosures

Third party information on over 85 million businesses in over 200 countries

Eliminates duplicate supplier information such as suppliers, inventory and revenues

Enables business and supplier authentication

Identifies hidden areas of risk across your supplier portfolio

Established Quality Assurance Process

37

In summary, these best practices to enable compliance with Sarbanes-Oxley

• Assign a champion in your procurement organization to lead efforts

• Ensure quality information is the foundation of your compliance strategy, not technology

• Enable access and analyze timely supplier information

• Automate your supplier registration process to enable supplier authentication

• Monitor all suppliers on annual basis and critical suppliers on a monthly basis to be ready for any real-time disclosures

• Review established procedures with your company auditors

TrendsTalk: Sarbanes-Oxley and your Supplier Registration Process

Q&A

aroram@dnb.com