In-Depth

Case Study: Bandag, a tire company, treads softly to SOX compliance

• By Kathleen Ohlson
• June 1, 2005

The rush to comply with the Sarbanes-Oxley Act was on in 2003, and Bandag was looking for a product that would help take the regulations head on, yet be user-friendly. Bandag manufactures tread rubber, equipment and supplies for re-treading tires. Its sells through more than 1,100 franchised tire dealers in more than 100 countries. “We used Excel spreadsheets [to document controls], and it was obvious that wasn’t going to work for us,” says Mark Johnson, Bandag’s internal control project manager. After analyzing offerings from 15 vendors, the tire company selected Paisley Consulting’s Risk Navigator to provide a framework for compliance and testing internal controls, as well as keeping executives informed and storing relevant information for auditors. Internal controls are procedures designed to ensure accurate financial data.

“We are not a Lotus shop, so we wanted them just to host it,” Johnson says. “[Hosting] lends itself to quick implementation… We wanted people to update the control database anytime, anywhere.”

The company started implementing Risk Navigator last spring for 200 employees and external auditors, who have read-only access. “The beauty of Web-based [systems] is you can have multiple people on at the same time, whether they’re in Europe, Brazil or at home,” Johnson says.

Johnson and his team needed to balance internal testing for control documentation and other requirements while coordinating with Bandag’s external auditors, causing time to become “a huge factor.” The Risk Navigator implementation went quickly, although Johnson and his team manually customized the product “business unit by business unit, control by control,” he says. “It’s a good way to do it, and we’re still adding business units, [so] we’re breaking it out by location.”

Risk Navigator is installed at Bandag’s headquarters, TDS subsidiary and international locations, including Europe, Mexico and Brazil, with plans to deploy it at the company’s Mexican operations.

Initially, there were a few bugs implementing Risk Navigator with enhancements Bandag didn’t want, and Paisley Consulting quickly addressed these issues, Johnson says. Each control owner, such as accounting, accounts receivable and accounts payable, has a sub-process owner, who evaluates risk and supports the control. Bandag would assign a control to a new person, but it would revert to the former sub-process owner, so a control couldn’t be signed off.

Another issue was implementing risks and controls in Bandag’s international locations, so the company wrote risks in English and the controls in the local language. According to Johnson, the company wanted its users to own the controls and sign off on them.

Managers were concerned about how controls would work in the new software. For example, accounting has dozens of controls while other units have one or two, but the process was much easier than expected, according to Johnson. Managers have a password to access their own links, finding all of the relevant information online.

Each issue and action plan is assigned to an individual, who can update them and send e-mails to auditors and others. Risk Navigator features a built-in tracking system and identifies who should be e-mailed a report. Any issues are tracked in English and can be followed even if an event takes place in foreign country.

“[Risk Navigator] takes management ownership,” Johnson says. “It’s one thing to say, ‘Yeah, we’re doing it.’ We have to say on the record that such-and-such data [exists] and saying this control is being done. That’s what’s good; it transfers from an auditing thing to a management thing, an auditing tool to a management tool.” For example, Bandag generates a report on approximately 2,000 controls, and users sign off on them if they are functioning. The report is done in a short turnaround time with Risk Navigator time-stamping the date on the report.

“You’re certainly happy when you get that last signoff,” Johnson says. “You archive it and then start up again. For a brief moment we’re done with this piece, but then it starts up again.”

Back to feature: Tools to Master the Sarbanes-Oxley Challenge