SCS Presentation - Corporate Governance

The Importance of Governance

In a Regulatory World

Dwayne Jorgensen, CIA, CFEConsultant, Governance Services

Spirit Consulting Services

AgendaAgenda

Introduction/Sarbanes-OxleyBrief historyHuman nature and the need for governanceCOSO overviewYour role Spirit or Letter of the Law?A Risk-based approach…Q&A

The Cost of Poor Governance:Sarbanes – Oxley in a NutshellThe Cost of Poor Governance:Sarbanes – Oxley in a Nutshell

The Act was signed into law on July 30, 2002 and includes eleven titled sections:

Title I Public Company Accounting Oversight BoardTitle II Auditor IndependenceTitle III Corporate ResponsibilityTitle IV Enhanced Financial DisclosuresTitle V Analyst Conflicts of InterestTitle VI Commission Resources and AuthorityTitle VII Studies and ReportsTitle VIII Corporate and Criminal Fraud AccountabilityTitle IX White Collar Crime Penalty EnhancementsTitle X Corporate Tax ReturnsTitle XI Corporate Fraud and Accountability

Brief HistoryBrief History

Thanks to Enron and the “.com implosion,”Governance became an issueCOSO’s Framework of Internal Control was published in 1992, but did not prevent the need for the Sarbanes-Oxley Act… Why?COSO was left “voluntary,” and therefore was essentially ignored for ten years by the business world, until made mandatory by the Sarbanes-Oxley Act.

Human Nature -The Need For GovernanceHuman Nature -The Need For Governance

Maslow's Hierarchy of needs– “Self-Awareness” is a desired, not required state.

Behavior styles and business management– Governance tends to be viewed as “overhead,” and has

historically been minimized on a “cost/benefit” basis.

Why is governance important?– Curiosity, greed, self-rationalization and pride, the key elements

of control breakdowns in historical business cases.

Human Nature The Need For GovernanceHuman Nature The Need For Governance

The Competency Square

Unconsciously incompetent

Consciously incompetent Consciously competent

Unconsciously competent

Unconsciously incompetent

Consciously incompetent

Consciously competent

Unconsciously competent

Human Nature The Need For GovernanceHuman Nature The Need For Governance

COSO - OverviewCOSO - Overview

• COSO Definition of Internal Control– Internal control is a process, effected by an

entity’s board of directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories:

• Effectiveness and efficiency of operations • Reliability of financial reporting • Compliance with applicable laws and regulations

• Key Concepts– Internal control is a process. It is a means to an

end, not an end in itself. – Internal control is effected by people. It’s not

merely policy manuals and forms, but people at every level of an organization.

– Internal control can be expected to provide only reasonable assurance, not absolute assurance, to an entity’s management and board.

– Internal control is geared to the achievement of objectives in one or more separate but overlapping categories.

RisksEvaluated by:– Severity– Likelihood

Types of risks:– Inherent risks– Managed risks– Residual risks

COSO - OverviewCOSO - Overview

COSO – OverviewCOSO – Overview

Dwayne’s “Hierarchy of Internal control needs”(First published 1990):

Control Self-

Assessment

Consulting

Operational

Compliance

Proactive

Reactive

COSO – OverviewCOSO – Overview

Hierarchy of internal control needs – revised (2004)– New Foundational Layers:

CSA

Consulting

Operational

Compliance

Proactive

Reactive

Objectivity

Independence

Your Role as “Teacher”Your Role as “Teacher”

Who is responsible for implementing the Internal Control Framework?– Management

Who should be responsible for overall Governance?– Not your external auditors

What is the preferred solution?– Senior management and internal auditors as teachers of Internal

Control

Your Role as “Teacher”Your Role as “Teacher”

Internal control expertise can provide assistance in every layer of the cube

Reactive

Proactive

Compliance

Operational

Consulting

CSA

Your Role as “Counselor”Your Role as “Counselor”

Why should management, internal and external auditors communicate?– Ensures company assessments,

documentation, testing and reporting are correct

– Lightens attestation load for external auditor (SAS 65)

Governance: Spirit or Letter of the Law?Governance: Spirit or Letter of the Law?

Sarbanes-Oxley: The “end” or “means?”– Act originally thought limited in life, now basis for many global

governance initiatives

Positive/negative effects of the intent for creating the ideal control environment– Too much focus on “letter of the law” (reporting requirements)

than “spirit” (corporate governance)

Ongoing debate over role of External Auditor– Act was direct result of audit firms acting as consultants, yet lines

are still blurred on using external auditors for consulting needs.– “4 – 3 – 2”

Spirit or Letter of the Law?Spirit or Letter of the Law?

Section 404– Can external auditors “independently” test and opine

on management’s report on internal controls if they played any role in preparing the document?

4-3-2


Section 302– Is management comfortable with this decision in light of

pending guidance on disclosure protocols, and the subsequent potential harm if something was deemed “inappropriate” about the external auditor’s role at a later date?”

4-3-2


Section 201– Since this assistance of operating management in

preparing their assertion falls outside the scope of actual external audit work, does it require audit committee approval, and is management therefore comfortable asking for it?

4-3-2

In the true “spirit” of the Act…In the true “spirit” of the Act…

Independent Internal Audit (IA) functionBoard-approved chartersRisk assessments – management & IA– Key Controls Determined by management assessments– Audit plans developed based on output of assessments

Testing and reports of effectiveness by IA– Correction of deficiencies by management

Management/IA as “teachers of internal control”Management/IA as part of continuous improvement process

In the true “spirit” of the Act…In the true “spirit” of the Act…

Thought-leading organizations were doing most, if not all, of the

previous prior to the Act, and were not even necessarily publicly

traded!

COSO – ERM FrameworkCOSO – ERM Framework

Have You Started Yet?

Enterprise Risk FrameworkEnterprise Risk Framework

Four objective categories –Strive to achieveEight components – Needed to achieveEntity and organizations units


Is a process- is a means to an end, not an end and itself.Is effected by people-is not merely policies, survey and forms, but involves people at every level of an organization.Is applied in strategy setting.Is applied across an enterprise, at every level and unit, and includes taking an entity-level portfolio view of risks.

Four objective categories-Strive to achieve

Eight components-Needed to achieveEntity and organizational units


Is designed to identify events potentially affecting the entity and manage risk within its risk appetite.Provides reasonable assurance to an entity’s management and board.Is geared to the achievement of objectives in one or more separate but overlapping categories Four objective categories-Strive to

achieveEight components-Needed to achieveEntity and organizational units

The Compliance IcebergThe Compliance Iceberg

Company-SpecificStandards

Sarbanes-Oxley ActCompliance Requirements

What You Know

What You MightNot Know

404

302301409

Cerner Regulations (FDIC 1A, etc.) Public Co. Reg. (NYSE, NASDAQ, etc.)

Lending CovenantsMission Statements

PoliciesProcedures

TasksUnique Control Events

© 2004 CTG



What You Know




What You Know


404

302301409

Cerner Regulations (FDIC 1A, etc.) Public Co. Reg. (NYSE, NASDAQ, etc.)

Lending CovenantsMission Statements

PoliciesProcedures

TasksUnique Control Events

© 2004 CTG



What You Know


Industry ComplianceStandards

Who’s Watching the Store?Who’s Watching the Store?

FrequencyResponsibilityRole

Annually

Periodically

Ongoing

COSO

Quarterly

Quarterly

Quarterly

SOX 302

External auditors

Internal auditors

Management

AnnuallyValidators independent of company

AnnuallyValidators independent of management, but part of company

AnnuallyOwner of internal controls and ongoing monitoring

SOX 404

Cost of SOX Implementation: 2005Cost of SOX Implementation: 2005

2005 SOX Expenditure by US firms: $6 Billion– Internal expenses: $2 Billion– Hardware/Software: $2 Billion– Consulting: $2 Billion

Source: Gartner

Cost of SOX Implementation: Ongoing?Cost of SOX Implementation: Ongoing?

A study from Foley & Lardner LLP shows that while the total cost of SOX compliance dipped in 2006, spending on so-called out-of-pocket costs rose by double-digit percentages.According to the Chicago-based law firm's study, public companies with more than $1 billion in annual revenue spent an average $10 million on costs such as board compensation and audit and legal fees in 2006. That's a 12% increase over spending in 2005. At public companies with revenue under $1 billion, the increase was 13%. External audit fees claimed the biggest chunk of money, accounting for more than 47% of the out-of-pocket spending on compliance by the smaller public companies. At companies with more than $1 billion in revenue, a whopping 60% of the money goes to external audit fees."Some experts predicted that external audit fees would decrease after the initial implementation of Section 404 audits, as external auditors became more familiar with their clients' accounting controls and, therefore, more efficient in conducting their audits," said Thomas E. Hartman, a partner at Foley & Lardner and director of the report. "Our study results do not support this prediction. Indeed, external audit fees have been the only cost our study has shown to increase every year since the Sarbanes-Oxley Act was passed."Meanwhile, all the manpower and money that companies have invested internally on SOX compliance is beginning to pay off. According to the Foley study, most of that dip in total SOX spending in 2006 was due to efficiency improvements in internal financial reporting -- and thus a gain in productivity. IT departments shouldered a big part of the internal work done in preparation for SOX -- cleaning up and documenting processes. Can CIOs give themselves a pat on the back? "CIOs will be able to pat themselves on the back when they sit down and help the rest of the business automate the internal controls as much as they can, and help get down the external audit fees, which are out of control," said analyst French Caldwell, who covers compliance at consultancy Gartner Inc. in Stamford, Conn. "It's not over yet. Don't even stop to catch your breath."Caldwell said the Foley findings are consistent with other research. During the last three years, companies have seen about a 35% reduction in overall SOX compliance costs, almost all of which have come from savings on internal labor and on fees paid to consultants. But a reduction in internal labor costs or one-time consultants doesn't equate with "any great efficiencies," he said, precisely because the external auditing fees have hardly budged -- indeed they're "out of control.""That indicates to me that there is just as much to audit. That indicates to me that many companies haven't really rationalized the controls. They haven't automated a lot of the controls," Caldwell said. Nor have companies yet heeded the advice this spring from the Securities and Exchange Commission (SEC) to take a more risk-based approach to SOX compliance.

Source: Linda Tucci, 16 Aug 2007, SearchCIO.com

So What’s a Corporation to Do?So What’s a Corporation to Do?

Continuous monitoring (CM) offers the only practical, cost-effective solution.– Build a system that provides a perpetual inventory

of governance– Leverage IT to maximize automation and reduce

staffing loads

Proposed CM Solution PyramidProposed CM Solution Pyramid

Hardware/Data Integrity ComponentEMC: Centera®, Proofspace encryption, record management automation

Hardware/Data Integrity ComponentEMC: Centera®, Proofspace encryption, record management automation

Software ComponentVarious vendor process automation products:

Ex.: Documentum®, Movaris OneClose®, ACL CCM®

Software ComponentVarious vendor process automation products:

Ex.: Documentum®, Movaris OneClose®, ACL CCM®

Co-sourcing component?Independent IT test services

Co-sourcing component?Independent IT test services

Planning ComponentSOX methodology:

Assess, document, test, report

Planning ComponentSOX methodology:

Assess, document, test, report

Oversight Component“Tone at the top”:

Executive buy-in, “spirit” vs. “letter”

Oversight Component“Tone at the top”:

Executive buy-in, “spirit” vs. “letter”

IT Components

Section302

Section409

Section 404

Risk Assessment

Control Environment

IT Risk Management,IT Risk Assessments,

Business Impact Analysis

“Tone at the top”, IT Governance, Regulatory Compliance

Firewalls, Security, DRP, Business Continuity, SDLC, Change Control,

Operations

IT Policies, Standards & Procedures Email, Scorecards, Dashboards, Project

Control, Help Desk

Server Logs, Database Logs, Firewall Logs, Intrusion Detection, Incident

Response, Awareness Training

Sarbanes-Oxley’s Impact on the COSO Cube Sarbanes-Oxley’s Impact on the COSO Cube

Monitoring

Information & Communication

Control Activities

One Close®OrganizationalConsulting

ACL CCM/One Close®

Documentum®

One Close®Te

chno

logy

(HW

/SW

)

Peop

le

(sta

ff, m

gmt.)

CM Solution RequirementsCM Solution Requirements

Risk Assessment

Control Environment

Monitoring

Information & Communication

Control Activities

Resourcesneeded

Tool or processneeded

(examples only):

Key RecommendationKey Recommendation

Validate methodology through execution on a pilot process (assess, document, and test)Remediate consistently and constantlyWork with external auditor to ensure approach is satisfactory via a full trial on a key process before rollout

Internal Control Maturity ModelInternal Control Maturity Model

Control structure is not defined. Control occurs incidentally.

Control structure is not defined, but control processes may occur based on past success and management oversight.

Control structure is documented, standardized and integrated into control processes for the organization.

The control process is regularly assessed and tested. Detailed measures of the control process are collected and reported.

Continuous process improvement is enabled by quantitative feedback from the control process.

Initial Repeatable Defined Managed Optimizing

Predictability, effectiveness and efficiency of an organization's internal controls improve as the organization moves through these five stages.

Initial

Repeatable

Defined

Managed

Optimizing

ProcessProcess OutcomesOutcomes

Management support

Internal champion

Trained team

Consensus on objectives

Risk-ranked universe

The plan

COSO-Driven Methodology: AssessCOSO-Driven Methodology: Assess

Formteam

Formteam

Perform riskassessment

Perform riskassessment

Confirmresults

Confirmresults

Developwork planDevelop

work plan

Define overall SO requirementsIdentify and form teamPartner with external audit firm

Confirm audit universeDefine risk weightingConduct assessment

Analyze assessment resultsConfirm risk rankingsMap to knowledge base of mitigating practices

Present findings to managementDevelop plan for documentation phaseReview plan with external auditor, management

Remediate

Ongoing coordination between management,external auditor, and consultant

ASSESSASSESS TEST REPORTDOCUMENT


ASSESS TEST REPORT

Remediate


COSO-Driven Methodology: DocumentCOSO-Driven Methodology: Document

COSOalignment

COSOalignment

Documentcontrol

activities

Documentcontrol

activities

Improve controls

Improve controls

Definemonitoring

process

Definemonitoring

process

Define target maturity level by processAssess COSO maturity by processIdentify where improvements are needed

Define control objectivesDetermine tool approachMap assessment to objectives and identify gaps

Develop plan to address gaps with control changesAssess and implement changes in controlsTest new processes and train users

Confirm the role of the internal audit departmentAssess current monitoring environmentImplement monitoring process

COSO maturity ranking

Consensus on end state

Improved controls environment

Ongoing monitoring

Documented controls

DOCUMENTDOCUMENT


Remediate


Management control monitoring

Independent monitoring

Management reporting process

Ongoing reporting

COSO-Driven Methodology: TestCOSO-Driven Methodology: Test

Managementcontrols

monitoring

Managementcontrols

monitoring

Materialweakness plan

Materialweakness plan

Ongoingreport process

Ongoingreport process

Educate management on controlsDevelop framework for management monitoringFacilitate management monitoring of controls

Identify weaknesses from management testDevelop action plan for weaknessesReiterate if necessary

Implement process for ongoing quarterly reportsDefine process for development of IC reportPartner with external auditor on report requirements

Independent internal audit

Testing

Independent internal audit

Testing

Develop framework for independent monitoringFacilitate independent monitoring of controls

ASSESS TESTTEST REPORTDOCUMENT


Remediate


COSO-Driven Methodology: ReportCOSO-Driven Methodology: Report

Managementreport

Managementreport

Externalaudit

Externalaudit

Externalcontrol testing

Externalcontrol testing

Externalauditor

assertion

Externalauditor

assertion

Management reports on role in controlsManagement reports on testing processManagement delivers final controls report

External audit commences

External auditor tests controls per requirementsExternal auditor reviews management reportExternal auditor issues final report

External auditor issues final assertion

ASSESS TEST REPORTREPORTDOCUMENT

Management report

External audit report

External assertion

Benefits/ROIBenefits/ROI

ROIs are easily calculated, by the determination of FTE reduction due to PCAOB’s Standard II regarding the testing of automated controls once, versus reiterative testing necessary for manual controls.Secondary benefit, especially in the ability to store the results of continuous monitoring in an authenticated, digital format, should have a significant impact on future third-party litigation revolving around alleged misconduct by management, in proving the validity of the effectiveness of key control activities.

Week Number 1 2 3 4 5 6 7 8 9 10Weeks Remaining: 10 9 8 7 6 5 4 3 2 1

# Task Description:1 Initial planning and information gathering2 Conduct initial interv iews3 Review Engagement Letter

4 Finalize interv iew list5 Finalize specialists required6 Prepare letter for interv iewees to overv iew project/ team 7 Prepare interv iew objectives and general questions8 Finalize workplan9 Develop overv iew of client business/industry

10 Finalize tailored questions by functional interv iew11 Draft format for deliverables

12 Schedule interv iews (approx. 25-35 interv iews)13 Perform interv iews (approx. 25-35 interv iews @ approx. 1.5 hrs each)

Interv iews led by IA with client internal audit personnel involvement 14 Document results of interv iews / confirm with interv iewees

15 Develop risk ranking 16 Develop audit plan 17 Determine resource needs to execute audit plan

18 Obtain client management consensus on risk profile 19 Finalize and present deliverables

Illustrative Assessment Work PlanIllustrative Assessment Work Plan

Control Assessment StructureControl Assessment Structure

General Controls Control COSO ControlCapabilities Component Risk Factors

Control Capabilities AuthorizationControl Environment Delegation of Authority

a) Authorization Authority and approval levels is not delegated to the low est levels.b) Processing and Recording Authority is delegated to the front lines how ever executive management is involved.c) Safeguarding Authority is delegated to the front lines and decision making resides at that level. d) Reportinge) Compliance Processing and

Recording Control Environment Skill sets

f) Risk Management Employees possess the know ledge and skills necessary to effectively execute their job.g) Resource Availability Employees possess some of the skills required to effectively execute their job.

Employees generally do not have the know ledge or skills to effectively execute their job.

COSO Control Components:Processing and Recording

Control Environment Volume of transactions

a) Control Environment Low volume of transactions and minimal interventions and hand-offs.b) Risk Assessment Average volume of transactions and considerable number of manual interventions.c) Control Activities High volume of automated and manual transactions and hand-offs.d) Information & Communicatione) Monitoring Risk

ManagementControl Environment Organization Structure

Operations are highly centralized with effective communication systems.Operations are fairly decentralized with fairly effective communication systems.Operations are very decentralized with ineffective communication systems.

Framework for Risk AssessmentFramework for Risk Assessment

Identify– What are the risks?

Measure– What is the relative degree of risk? (Determined by

Severity and Likelihood.)Prioritize– Which risks are most important?

Risk Assessment: The Big PictureRisk Assessment: The Big Picture

Internal and external risks faced by all organizations.Requires linked and consistent management objectives.Identified/analyzed to manage and achieve objectives.A system to address organization impact of external and internal condition changes.

IIA Definition-“… a systematic process for assessing and integrating professional judgments about probable adverse conditions

and/or events. …organize and integrate professional judgmentsfor development of the audit work schedule.”

Enterprise Risk Assessment

Driven by enterprise strategies and overall goals.

Risk rank audit universe, applying the same risk factors to all audit entities.

Top-down focus begins at the enterprise level.

Bottoms-up begins at the entity level.• Approach dependent on management’s objectives and

other initiatives in place.

Enterprise Risk Assessment DefinedEnterprise Risk Assessment Defined

Enterprise Risk – Potential exposures which could significantly impact or impede an enterprise’s ability to succeed in accomplishing its overall financial and operational goals and objectives.Risks can be categorized as follows:– Strategic – relating to high-level goals, aligned with and

supporting the entity’s mission/vision.– Operations – relating to effectiveness and efficiency of the

entity’s operations, including performance and profitability goals.– Reporting – relating to the effectiveness of the entity’s reporting.– Compliance – relating to the entity’s compliance with applicable

laws and regulations.

Ways To Look At RiskWays To Look At Risk

Quantitative• Assign a value to each control risk times a probability

of the threat of the risk• Higher value/greater risk

Qualitative• High, medium, low or adequate/inadequate

Approaching Risk Assessment

Solicit executive management’s enterprise strategies, goals, objectives and concerns.

If applicable, obtain external auditor’s perspective of the company.

Also consider insurers, outside counsel, other third-party service providers.

Capture organization, products, processes, functions, locations, systems, support areas, etc. relevant to auditable entities.

Develop a model using risk factors, weightings and scoring criteria.

Objective is a risk-ranked audit universe.

An Enterprise Risk Assessment Tool

Provide analyses regarding risk exposures at an audit universe (enterprise) level.

No pre-defined database of standard questionnaires, risk factors and set risk weightings.

Information compiled by experienced professionals.

Information/analyses as good as the information compiled.

Types of Risk FactorsTypes of Risk Factors

Assets at risk• Cash• Inventory• Intellectual property

Operational• Procurement• Production• Material Handling• Sales• Service• Human Resources• Planning• Legal• Environmental

Systems• Information quality• Security• Disaster planning• Equipment/software

Financial • Data accuracy• Available information• Completeness of data• A/R, A/P, Cash flow,

etc.

Risk Weighting and Scoring

Weigh risks based on customized criteria.• Relative importance of individual risk factor. • Risk factor impact on business units based on

likelihood of occurrence and severity of impact.• Facilitate with management and process owners.

Risk weighting results reviewed by management and the process owners.• Risk score is assessed for each risk factor. • Scores summed for a total risk score. • Supports risk ranked audit universe.

Risk-based Approach: ExamplesRisk-based Approach: Examples

Business ProcessesAlignment

Business ContinuityComplianceContracting

EmpowermentEnvironmental

FraudHealth and SafetyIllegal Activities

Management InformationObsolescence/ShrinkageProduct/Service Quality

RelevanceUnauthorized Use

TechnologyAvailability

AccessFunctionality

IntegrityUsability

Functional Risk

FinanceCollateral

CounterpartyCredit

CurrencyDerivatives

Interest RateLiquidity

ReinvestmentSettlement

Financial ReportingFinancial Assessment

EvaluationFinancial Statement

FalsificationRegulatory Reporting

Taxation

Strategic Risk

Capital AvailabilityCompetition

Financial MarketsFlexibilityIndustry

LeadershipLegal

RegulatoryProduct Life Cycle

Product DevelopmentReputation

Trademark ErosionSovereign

Strategic AssumptionsValuation

AuthorityBench Strength

Budgeting & PlanningCapacity

CommodityCommunication

Cycle TimeEfficiency

Human ResourcesOrganization Structures

Performance MetricsPricing

Resource AllocationSupplier

Technology SelectionTechnology Deployment

Conversion Risk

Risk-based Approach: ProcessRisk-based Approach: Process

Company StrategiesExecutive Management Input

Risk Factor ModelDevelopment

• Executive Management Input and Buy-in

• Extract Risk Factors from Strategies

• Identify & Define Risk Factors to be Used

• Define Related Scoring Criteria for Each Risk Factor

• Weight the Risk Factors

Audit UniverseDevelopment

• Input Obtained from Many Sources

• Organizational Charts, Internal Management Reports, Company Directory, Annual Report, General Ledger, Location Listings, Major Projects or Contracts, Information Systems, etc.

• Cost Centers, Profit Centers, Investment Centers, Locations, Functions, Processes, etc.

Risk ExposureScoring

• Scoring Occurs from Interviews with Senior Management Responsible for the Auditable Entities

• One Person may be Responsible for Scoring Multiple Entities

• Many Persons may be Responsible for Scoring One Entity

Audit PlanDevelopment

• Compute Risk-Ranked Audit Universe from Completion of the ERA model

• Develop Audit Plan Based on Risk-Ranking and Available Resources

• Obtain Executive Management Approval

• Execute Audit Plan

• Reassess Risk Exposures

Risk-based Approach Re-capRisk-based Approach Re-cap

Risk-based approachDefined model of enterprise risk factorsCustomized to fit our client’s needsEfficient direction of audit resourcesSupported by an electronic tool that provides for data analysisProvides sufficient information to build an audit planPerformed by experienced professionalsCost effective solution to improve enterprise risk management initiatives

Questions?

Dwayne Jorgensen, CIA, CFEConsultant, GovernanceSpirit Consulting Services

Dwayne Jorgensen, CIA, CFEConsultant, GovernanceSpirit Consulting Services

Dwayne Jorgensen, CIA, CFE, is a recognized expert in governance, risk and controls. Mr. Jorgensen created the Sarbanes-Oxley Services & IT Governance global practice for CTG, a 39-year old IT staffing solutions firm. He is respected for his ability to assess a clients’ current state of compliance with Sarbanes-Oxley (SOX) and then guide them in meeting their compliance goals, especially those related to Sections 302, 404, and 409 of the act. In addition, Mr. Jorgensen has developed a “continuous monitoring” solution for corporate governance and speaks on the role of IT in that endeavor. Mr. Jorgensen is an expert in COSO, risks and controls, specifically as these areas pertain to the impact of SOX on corporate governance. He has over 20 years’ experience in internal audit, system controls, practice development, capital acquisitions, and risk management.Before CTG, Mr. Jorgensen was North American Practice Director of internal audit services for Jefferson Wells International. He oversaw the growth and development of the firm’s internal audit service line in the United States and Canada post-Sarbanes-Oxley, especially in the areas of 301, 302, and 404 compliance. He also directed the business process outsourcing practice for the Atlanta office of Arthur Andersen, LLP, and was elected a principal of the firm. He was a senior manager for Coopers & Lybrand, LLP, and director of internal audit and secretary of the audit committee for a Flagler System, Inc. Mr. Jorgensen is a member of the Institute of Internal Auditors and the Association of Certified Fraud Examiners, and has a Bachelor of Arts degree in pre-law with a major in accounting and finance from the University of Illinois-Urbana.

Dwayne Jorgensen, CIA, CFEConsultant, GovernanceSpirit Consulting Services – Referrals

Dwayne Jorgensen, CIA, CFEConsultant, GovernanceSpirit Consulting Services – Referrals

“I had the opportunity to work with Dwayne during an extremely critical period as our company attempted to address Sarbanes Oxley concerns. Dwayne and his team were simply the best of the best. I highly recommend Dwayne and would welcome the opportunity to work with him again.” April 1, 2008 Top qualities: Great Results, Expert, High Integrity Mike Pulaski - hired Dwayne as a Business Consultant in 2004, and hired Dwaynemore than once“Dwayne was directly responsible for developing Jefferson Wells approach to provision of Sarbanes Oxley services just after the act was passed by congress. He was on the leading edge of the service. His leadership was instrumental in subsequent success the company enjoyed.” January 7, 2008 Bob McDonald, Director Construction Services, Jefferson Wells International - worked indirectly for Dwayne at Jefferson Wells International“Dwayne took a leading role in developing the regulatory compliance practice in the UK operation. I found Dwayne to be very commercially focused and felt his strengths were in developing a lasting relationship with the client.” January 8, 2008 Martyn Smith, Senior Consultant, CTG (UK) Ltd - worked with Dwayne at CTG“Dwayne was the key provider in the delivery of an excellent Sarbanes-Oxley assessment audit of our business processes and provided specific and creative recommendations for implementation of corrective actions.” January 4, 2008 Top qualities: Personable, Good Value, On Time John Ponzo - hired Dwayne as a IT Consultant in 2004“I encountered few people in the three years I was selling SOX and GRC applications that truly understood the intertwined nature of a control environment and technology. Dwayne understood the pro's, the con's and the yet to be challenged status quo. Dwayne knew early that complex control issues could be tackled efficiently using technology and at a reduced overall cost. Simply put Dwayne "gets it"!” January 28, 2008 Brian Tietje, Senior Sales Consultant, Movaris - was with another company when working with Dwayne at CTG

Contact InformationContact Information

Dwayne E. Jorgensen, CIA, CFE ConsultantSpirit Consulting Services 1851 Baltusrol TrailDuluth, GA 30097Office: 678/957-0838Mobile: 770/789-7581E-mail: [email protected]

Thank You!

SCS Presentation - Corporate Governance

Business

Transcript of SCS Presentation - Corporate Governance