Safeway Cuts Costs in Sarbanes-Oxley Compliance

ELLIOT ZWIEBACH

SAN DIEGO — Sarbanes-Oxley is here to stay, and retailers must adapt to meet its requirements, a Safeway executive said here last week.

“It's not going to be repealed — certainly not under this Congress,” Bill Spoehr, vice president, financial compliance, for Safeway, told CUE 2007, the annual conference and user exchange sponsored by Lawson Software, St. Paul, Minn.

Sarbanes-Oxley added requirements in 2002 — in response to accounting scandals at Enron and other corporations — that all public companies and their auditors must review internal controls.

According to Spoehr, though it's been a struggle for companies to develop compliance systems over the last few years, the process is finally reaching maturity, with more clarity on what companies need to do to comply.

“It's been a difficult process,” he said, but with clarifications to Section 404 of Sarbanes-Oxley — which requires companies' executives to produce internal control reports that affirm their responsibility for establishing and maintaining adequate internal controls for financial reporting — the ways to comply have become a lot clearer, Spoehr pointed out.

“What the government said was, if a company complies with the rules in that section, it will be in compliance with Sarbanes-Oxley,” he pointed out.

“The goal [of the clarification] is to reduce the risk that a material misstatement will remain undetected by management for an extended period, and it also seeks to make sure honest mistakes don't end up in a company's [year-end] financial statements.”

Section 404 only runs six sentences, he noted, “yet there's been a lot of money spent by a lot of companies to comply, and the latest clarification will help alleviate” some of the issues companies have had to deal with.

Safeway has been in compliance with Sarbanes-Oxley for three years and has made steady improvements in terms of execution and efficiency from year to year, Spoehr said.

During 2004, it was “a huge task,” he recalled, that involved 150 people working 200,000 man-hours to create documentation, with little guidance from either the Securities and Exchange Commission or from the chain's own auditors, “who were not allowed to give advice, though they certainly were free with advice if they felt we did something wrong.”

Starting from the bottom up, Safeway looked at every piece of paper and documented and tested more than 1,400 key compliance controls, Spoehr said.

In 2005 Safeway established a central compliance department, based in Phoenix, that was able to take a more focused approach to the task — utilizing just five full-time employees and consultants who worked a total of 40,000 man-hours and got the compliance control count for testing down to 895, Spoehr recalled.

“But the system was still inefficient and relied heavily on manual databases that left room for considerable improvement,” he said.

In 2006 Safeway installed a compliance control management system from Lawson that reduced the workload to fewer than 25,000 man-hours and reduced the key control count to 589.

According to Brant Borchert, Safeway's manager of financial compliance systems, the new system enables Safeway to keep track of compliance without reviewing every process continuously.

“Rather than documenting all controls every year and then starting over again at the beginning of the next fiscal year, the system contains all the information and has the flexibility to react to the pace of change in guideline requirements,” he explained.