UK Project Risk Management And SOX

Ben,

Just a suggestion/thought....have you considered using the FOIA and contacting government departments the ODPM etc regarding their positions as there may be impacts upon OGC policies.....the IT project that springs to mind is the the NHS computer system.

Hi Alan,

Thanks for getting back to me. That’s a great suggestion. Do you have any contact details or weblinks that I could follow through to get to a relevant contact at all ?

Kind Regards,

Ben

Ben,

Just to clarify a position, SOX i assume you mean the Sarbannes Oxley Act....before i rattle on can you confirm this.

Alan

Oh yes, I do indeed mean The Sarbanes-Oxley Act, that joyful piece of US legislation that I have been studying solidly for two months now.

I know that on the outset, it will affect UK projects mostly on auditing and financial issues. However, project risk will play an important part of the auditing issues, especially with sections 302 and 404, for UK projects.

This, as I understand it, is relatively new in the UK project environment. That, and its controversial nature, have made it hard for me to establish contacts !

Ben,

I cant say that i have read the Act at all....but i am having a little difficulty imagining what types of projects would be affected and how risk could be manifested into a project by an accounting prcedure.

First off, what type of project(s) are you looking at and who sponsors/promotes them and what the proposed finacing vehicles are for the project(s), a few scenarios spring to mind.

Lets take government projects first, i can only assume that the projects that you are looking at, Special Purposes vehicles are set up and funds are raised in a manner other than taxation (fuel, booze, fags income, VAT etc), my reasoning being that authorities (whoever they are) receive budget allocation from central government each year which comes from this coffer and would not be subject to market volitility (stocks, interest rates, FX etc)....this only leaves major long term projects, lets say the design, build, construct of lets say (getting a bit too close to home here) replacement of the Trident fleet.

Would the risk manifest itself by the fact that whoever the financial advisers are proposed high risk investments...is this the type of angle that you are pitching at ?

The angle I am looking at is this:

SOX section 404 goes through project accounts and checks for "material weaknesses" - a vague term in itself - with your project finances and risk procedures. If such weaknesses are found, this could have serious implications for a project, with funding and shareholder investment being pulled - such being the nature of risk adverse investors. Added to this is SOX section 302, which holds CEO’s and CFO’s (and arguably project managers) personally responsible to make sure their project finances and risk procedures are in order, or else they could be facing jail. The Act also notes that just because a project is outside of the US, does not mean that it is excluded from these laws i.e. a UK based project that has US affiliations will still be liable to SOX and therefore UK project leaders undertaking SOX projects could potentially face these liabilities.

Now, how this applies to UK projects in terms of my dissertation is:

1) At the expense of innovation and business risk, is SOX punishing those who take risks and making the market risk adverse through section 302 ?

2) Are all SOX requirements adding unnecessary bureaucracy for risk procedures in UK projects ?

3) Is SOX really having an impact on Uk project risk culture, or are we just ticking boxes ?

Ben,

Just read parts of the Act, if you are familar with any UK Acts, they are written in the same manner i.e they are not prescriptive, they just tell you what you must achieve, not how you achieve it....try the DDA’s or TWA’s.

Are you familiar with the:

H M Treasury Green Book; Investment Appraisal etc
OGC: Managing Successful Programme
OGC: Prince 2
OGC: Management of Risk

It all sounds to me like SOX is intended to force business to take these measures, implement these types of controls not simply on projects but on strategy and programmes as well.

Several stories that i could compare private sector to public sector, project successes and project failures....but this is not the place.

Alan,

Absolutely right. SOX is precisely designed to force projects to undertake these methods. The debate as far as risk is concerned is: is it actually improving risk processes or just creating unnecessary burdens ?

For instance, SOX cares greatly about financial risk taken by a project, but it doesn’t care about operational risk.

My aim is trying to find someone who deals with these risk issues in SOX projects carried out in the UK