Holistic Compliance

With a torrent of regulations raining down on them, Wall Street firms are wise to think about developing a global-compliance architecture. But can the chief compliance officer sell the project to senior management?

SOX: Auditing Financial Controls

Not only do securities firms have to find their data, but in the case of Sarbanes-Oxley they have to document their processes, controls and workflows. "Sarbanes-Oxley is really the opportunity for a CIO to harmonize his data and to simplify a lot of the financial data that flows around the firm," says Rzasa.

Although financial systems are housed in the data center, Rzasa has observed that people download data to the desktop or manipulate data in a spreadsheet. "It's never backed up, it's not accounted for, yet it's used in producing financial statements or statements used by the firm to make announcements," he told the audience at the InformationWeek event.

"From the CIO's perspective, now is the time to start auditing your entire information flow of your financial records and ensuring along the way there is data integrity, there is backup, and that you can tie the end-document back to the original source of the data," says Rzasa.

While the media has focused on the certification of the accuracy of financial statements, Cohen cautions, "The requirements of SOX are far broader than that."

Under the much-dreaded section 404 of SOX - which takes effect beginning with a company's fiscal year ending on or after June 15, 2004 - "CEOs and CFOs have to examine the adequacy and effectiveness of all of the internal controls that go into the end-product of producing financial statements," says Cohen. "You have to focus on the little steps within your business, and there could be thousands, hundreds of thousands, or millions of steps within your business, and the controls around those steps, that lead into the financial picture of the organization."

In MONY's case, the firm is using a software program from one of the Big-Four accounting firms. The software will identify processes through the company that may have an impact on the validity of its financial reports, and produce a list of requirements for every process that has to be met for its financial controls.

"All that documentation is going to be helpful from a business and compliance perspective," says Cohen.

But MONY is not putting the information into a different architecture. It's using a tool to analyze the underlying processes and the existing information systems, he says. "We're not going to a global architecture. It may take too long. It may be too expensive," he says, noting that the global compliance architecture makes sense for a firm starting from scratch.

Cohen suggests it's more practical to use vendor tools that will analyze all the information for sales practices or suitability issues in all of a firm's legacy systems. "Those systems aren't cheap," he says. "But for a company like ours, it may be easier than trying to develop a whole new IT infrastructure."

Given that brokerage firms are spending more on compliance already, will the concept of an enterprise-wide-compliance architecture fly on Wall Street?

Iati admits the business side has no appetite to spend $50 million on strategic initiatives, but he believes, "The trend is moving with the right mix in the right direction." In the past, compliance has been viewed "as a nuisance request. I have to produce something for the Fed in three days," was the attitude. "There was no one in the high level to push it. It always lost out to that sexy trading system."

Now, there's more recognition of compliance as a high-profile topic that can be related to wider issues, such as terrorism, corporate-accounting fraud at Enron, Tyco and Worldcom, and the alleged wrongdoing of prominent figures such as CSFB's Frank Quattrone.

Now it's clear failure to comply will result in fines, felony charges and damage to career and reputation. Also, many firms have appointed a chief compliance officer who is there to push the issue.

While no one knows whether the global compliance platform is something that will materialize, the answer may come down to time and money. "Brokers have to determine whether compliance is a strategic business issue or a quick technology fix," says Iati.

Ivy is Editor-at-Large for Advanced Trading and Wall Street & Technology. Ivy is responsible for writing in-depth feature articles, daily blogs and news articles with a focus on automated trading in the capital markets. As an industry expert, Ivy has reported on a myriad ... View Full Bio

2 of 4