Case Study: Bandag, a tire company, treads softly to SOX compliance
- By Kathleen Ohlson
The rush to comply with the Sarbanes-Oxley Act was on in 2003, and Bandag was
looking for a product that would help take the regulations head on, yet be user-friendly.
Bandag manufactures tread rubber, equipment and supplies for re-treading tires.
Its sells through more than 1,100 franchised tire dealers in more than 100 countries.
“We used Excel spreadsheets [to document controls], and it was obvious
that wasn’t going to work for us,” says Mark Johnson, Bandag’s
internal control project manager. After analyzing offerings from 15 vendors,
the tire company selected Paisley Consulting’s Risk Navigator to provide
a framework for compliance and testing internal controls, as well as keeping
executives informed and storing relevant information for auditors. Internal
controls are procedures designed to ensure accurate financial data.
“We are not a Lotus shop, so we wanted them just to host it,” Johnson
says. “[Hosting] lends itself to quick implementation… We wanted
people to update the control database anytime, anywhere.”
The company started implementing Risk Navigator last spring for 200 employees
and external auditors, who have read-only access. “The beauty of Web-based
[systems] is you can have multiple people on at the same time, whether they’re
in Europe, Brazil or at home,” Johnson says.
Johnson and his team needed to balance internal testing for control documentation
and other requirements while coordinating with Bandag’s external auditors,
causing time to become “a huge factor.” The Risk Navigator implementation
went quickly, although Johnson and his team manually customized the product
“business unit by business unit, control by control,” he says. “It’s
a good way to do it, and we’re still adding business units, [so] we’re
breaking it out by location.”
Risk Navigator is installed at Bandag’s headquarters, TDS subsidiary
and international locations, including Europe, Mexico and Brazil, with plans
to deploy it at the company’s Mexican operations.
Initially, there were a few bugs implementing Risk Navigator with enhancements
Bandag didn’t want, and Paisley Consulting quickly addressed these issues,
Johnson says. Each control owner, such as accounting, accounts receivable and
accounts payable, has a sub-process owner, who evaluates risk and supports the
control. Bandag would assign a control to a new person, but it would revert
to the former sub-process owner, so a control couldn’t be signed off.
Another issue was implementing risks and controls in Bandag’s international
locations, so the company wrote risks in English and the controls in the local
language. According to Johnson, the company wanted its users to own the controls
and sign off on them.
Managers were concerned about how controls would work in the new software.
For example, accounting has dozens of controls while other units have one or
two, but the process was much easier than expected, according to Johnson. Managers
have a password to access their own links, finding all of the relevant information
Each issue and action plan is assigned to an individual, who can update them
and send e-mails to auditors and others. Risk Navigator features a built-in
tracking system and identifies who should be e-mailed a report. Any issues are
tracked in English and can be followed even if an event takes place in foreign
“[Risk Navigator] takes management ownership,” Johnson says. “It’s
one thing to say, ‘Yeah, we’re doing it.’ We have to say on
the record that such-and-such data [exists] and saying this control is being
done. That’s what’s good; it transfers from an auditing thing to
a management thing, an auditing tool to a management tool.” For example,
Bandag generates a report on approximately 2,000 controls, and users sign off
on them if they are functioning. The report is done in a short turnaround time
with Risk Navigator time-stamping the date on the report.
“You’re certainly happy when you get that last signoff,”
Johnson says. “You archive it and then start up again. For a brief moment
we’re done with this piece, but then it starts up again.”
Back to feature: Tools
to Master the Sarbanes-Oxley Challenge
Kathleen Ohlson is senior editor at Application Development Trends magazine.