Emcor Group Inc. is developing a Notes-based system to track its Sarbanes-Oxley compliance — a low-cost project that it chose as an alternative to a potential six-figure investment in commercial software and IT consulting services.
Emcor, a US$4 billion company that installs mechanical and electrical systems in commercial buildings and offers a variety of facilities outsourcing services, plans to start using the Notes system in test mode at some of its operating units next month. The technology is due to be rolled out company-wide by year’s end.
Emcor executives last week said they decided to take a “build” rather than a “buy” approach after evaluating during the first half of last year packaged tools and Sarbanes-Oxley consulting programs that are being offered by the Big Four accounting firms.
The cost of developing the compliance tracking system will be “significantly less” than what Emcor would have had to pay for off-the-shelf software, CIO Joseph Puglisi said last week at the company’s headquarters in Norwalk, Conn. Emcor also won’t have to add any hardware, software or storage to support the compliance system because it can piggyback on an existing Notes installation, Puglisi said.
In addition, the packaged applications that Emcor considered would have required “heavy customization” to meet the company’s business requirements, said Joseph Corris, its manager of financial analysis and leader of the Notes project.
Work on the project began last August. “We didn’t take any shortcuts by developing this system ourselves, but we will end up saving the company some money as a side benefit,” Corris noted.
Emcor doesn’t have an internal application development team, so it contracted with Phoenix-based Brazen Technology Inc. to develop the Notes database for the new system, which is called Socrates — short for Sarb-Ox Compliance Reporting and Tracking Executive System.
The technology is designed to track the financial reporting controls used by Emcor’s 85 business units in the U.S., Canada and the U.K., as required by Section 404 of the Sarbanes-Oxley Act. Emcor currently is working to populate the Notes database with documentation that spells out its internal control procedures and the requirements imposed by the financial reporting law.
Puglisi recommended that Emcor work with Brazen, but he noted that the finance department has taken the lead on the project. “The business knew what they wanted, and they came to IT for support,” he said. “It’s not my project, but we can support it from an infrastructure standpoint.”
Most large companies are buying Sarbanes-Oxley compliance tools, although some have developed their own systems “as a stopgap measure” until packaged tools become more mature, said John Van Decker, an analyst at Meta Group Inc.
But Troy Edgar, president and CEO of Global Conductor Solutions Group, a management consulting firm based in Los Alamitos, Calif., said that companies like Emcor with annual revenue in the range of US$1 billion to US$5 billion are tending to build homegrown systems.
After Brazen completed an initial iteration of the Notes system in September, Emcor recommended some nomenclature changes to the database’s template “to make it more audit-friendly,” Corris said. Emcor also asked Brazen to develop additional end-user screens, such as views of major customer accounts.
A second version of the system was completed in late November. Emcor expects the upcoming tests of the controls documentation at its operating units to take until September to finish, Corris said.
To comply with Sarbanes-Oxley, the system needs to be completed by the time Emcor’s fiscal year closes on Dec. 31. With the site testing not due to be completed until just three months before the deadline, meeting the rollout schedule “is going to be a crunch,” Corris said. “But that still gives us some extra cushion for any final revisions that might be needed.”
