Enterprise Risk

CareNetWest Companies, Inc.
Lynelle Martinez-Smith
July 20, 2006

Situation Background
CareNetWest (CNW) is a large healthcare company that has grown almost exponentially in the past two years. In addition to dealing with issues of rapid growth, they are now facing required adherence to the Sarbanes-Oxley Act of 2002. Sarbanes Oxley (SOX) requires that publicly owned companies disclose all matters related to financial activities within the organization to minimize any possibility of dishonest financial disclosures to the public (Week 4, Read Me First, U of P). Along with the rest of corporate America, at the end of 2002 CNW headed into its first period of SOX compliance (Scenario Two: CareNetWest Companies, Inc., U of P).

Issue Identification
With the compliance requirements deadlines now fast-approaching, CNW is faced with many issues in order to meet them. One issue that presents for CNW is that there is no regulatory compliance subject matter expert on the Board of Directors. This is a challenge because a compliance expert on the Board could raise compliance questions or issues to the CEO associated with any current or future financial decisions.

Another issue that exists is that there is an overall lack of compliance experience among the leaders of CNW. They have recently lost their Chief Risk Officer (CRO), Jane Michaels, at this critical time when compliance deadlines are imminent. During her time with CNW, Ms. Michaels made several attempts to bring the compliance regulation requirements to the attention of Dr. Tad Smith, Chief Executive Officer (CEO). Dr. Smith repeatedly ignored Ms. Michaels’ warnings, assuming she and Chief Financial Officer (CFO) Anders Williams would deal with “accounting matters” (Scenario Two: CareNetWest Companies, Inc., U of P).

This leads to the issue of the lack of communication and coordination among the CNW leaders, which heightens the lack of compliance knowledge issue. As CEO, Dr. Smith needs to have a minimum of a high-level knowledge of all issues affecting the organization. Only when he has a good knowledge-base of the issues can he entrust his leaders to handle the issues. Ms. Michaels had absolutely no backing from Dr. Smith on the issue of SOX.

Finally, CNW is faced with the enormous task of becoming compliant with the new SOX reporting requirements. Besides the fact that Dr. Smith has little idea of the implications SOX will have on his organization, he seems to have no grasp of the enormity of the project.

Stakeholder Perspectives
“Corporations should attempt to maximize not the value of their shares (or financial claims), but rather the total value that is distributed among all corporate “stakeholders,” including employees, customers, suppliers, local communities, and tax collectors” (Chew, 2005). Whenever executives have to make strategic decisions that affect key stakeholders, competing interests can lead to different levels of cooperation (U of P, 2006). It is critical that CNW considers all stakeholders in any and all business decisions, particularly those involving matters of compliance. Although stakeholders may not necessarily play a direct role in the governance, they should be at the forefront when corporate leaders are making critical business decisions.

Opportunity Identification
With the identification of several issues as they relate to the key stakeholders, CNW can realize several opportunities. Within CNW, there are as many opportunities as there are issues. However, there is an insurmountable amount of work to be done in a relatively short amount of time, and CNW must move quickly and make appropriate decisions.

One opportunity CNW has is to begin learning about compliance to SOX reporting standards in both corporate and healthcare management. Coupled with that is the opportunity to put overall disclosure compliance at the forefront of business. One way to help accomplish this task is to bring compliance expertise to the Board of Directors, as currently the Board has vacancies in the Audit, Governance, and Compensation committees (Scenario Two: CareNetWest Companies, Inc., U of P).

There is the opportunity to increase communication and coordination among the leaders as they learn and develop a SOX-compliant protocol and report. Communication can be enhanced by taking advantage of the opportunity to hire an assertive CRO who is experienced in the field of healthcare risk management. CNW may also want to consider hiring an outside consulting firm to get them up to speed quickly, as SOX compliance is likely to cost them a large amount of time and money; bringing in professional consultants may help minimize unnecessary spending of both.

Problem Definition
The problem that currently exists is that CNW is not SOX compliant, nor do they have a company specific roadmap to guide them in becoming compliant. They need to develop a protocol that outlines how to proceed in becoming compliant with governance implementation.
CNW will have complete understanding of all financial disclosure regulations and will have developed a complete protocol designed to assist in the development of a full disclosure report for SEC submission and other governance implementations.

Although reaching a level of compliance that will satisfy the SOX regulation is a major problem, it is not an unusual problem; in fact, nearly all publicly traded organizations have had to move quickly to meet SOX requirements: “SOX…has transformed the required control structures of most public companies in this country, forcing each to employ extensive resources to ensure initial and ongoing compliance” (Week 4, Read Me First, U of P). Benchmarking other publicly owned companies will help them develop a protocol that will work for them.

End-State Goals
Determining their end-state goals will identify how the businesses within CNW will know they have become what they want to become (U of P rEsource, 2005), thereby allowing CNW to realize its end-state. As stated earlier, CNW needs to have complete understanding of all financial disclosure regulations and will have developed a complete protocol designed to assist in the development of a full disclosure report for submission to SOX and other governance implementations.

The goals to meet this desired end-state are as follows:
Bring in whatever outside professional assistance that is available to begin immediate internal financial audits.
Become fully knowledgeable of financial disclosure regulations and requirements.
Develop a financial disclosure protocol designed to guide them through future annual external audits and other disclosure requirements.

This set of goals defines the desired future state and can be used to evaluate alternatives as they develop. The goals adhere to SMART (specific, measurable, attainable, realistic, and time-bound) parameters, and allow for many solutions.

Identifying and Evaluating the Alternatives
The logical alternatives CNW should consider and evaluations of each are outlined in the following paragraphs:

Hire external SOX consultants to implement compliance to SOX reporting standards in both corporate and healthcare management. This alternative provides a “quick fix” to their immediate problem of non-compliance. Selection of this alternative could mean relinquished control on the parts of the corporate leaders.

Learn and develop a SOX-compliant protocol and report without external assistance. CNW would need to learn compliance at a pace they may not have the time to implement.

Hire a new CRO who has experience in the field of healthcare risk management to oversee all financial disclosure activities. This alternative solves the issue of lacking risk assessment and management.

Convince Jane Michaels to come back as the CRO, reporting directly to the CEO. In this scenario this could be construed as the best solution; however, it is based on the assumption that Ms. Michaels will want to come back.

Hire experts in the areas of Governance, Audit, and Compensation onto the Board of Directors. This alternative addresses the problem of missing compliance expertise on the Board, and it may serve CNW well to combine this alternative with one or more others.

Hire an outside audit consulting firm who specializes in SOX regulations. This alternative will definitely help CNW ensure that their internal controls are adequate for external audits.

Develop a financial disclosure protocol designed to guide them through annual audits and other disclosure requirements. As a long term solution, this alternative will serve CNW well for future audits, but may not solve the immediate problem.

CNW should use a system that used the end-state as the means to measure the success of their plan as they worked through each end-state goal. There will be room for changes as they progress through their compliance plan because the problem-solving model allows for flexibility.

Risk Assessment
Although CNW has identified pros and cons associated with each alternative, they must still assess all levels of risk each alternative poses in order to make the best possible business decision. “Once risks are identified, the challenge is defining them in risk-management terms” (Journal of Commerce, 2006). CNW must now define individual risks and determine whether the risks are acceptable or not to proceed with their decision of an optimal solution.
Some of the risks associated with the alternatives are largely based on assumptions. For example, it is assumed that CNW will place financial disclosure compliance at the forefront of business, and will implement a plan to keep it there.

The assumption exists that a CRO (whether Ms. Michaels or someone new) can be aggressively hired and working at full speed when the time comes to submit the disclosure report.
There is also the assumption that external experts are actually available to come into CNW on a consulting basis to perform internal audits and education. The risk exists that external experts will not be available for CNW in the timeframe in which they are needed.

Finally, there is the assumption that SOX compliance will consume large amounts of resources (employees, time, and money). This is a good assumption because benchmarked data shows evidence of dollar amounts spent by other organizations to become compliant.

Additional risks other than assumptions include:
· Extensive use of resources (time, money, and employees)
· Non-compliance to financial disclosure requirements
· Continued lack of business skills during compliance planning
· Non-compliance will lead to fines and investor mistrust
· Business will weaken over time without having appropriate talent in the proper roles

Making the Decision
The scenario does not specify any deadline in which the company must be fully compliant; only that beginning in 2003, a 10Q form needs to be completed indicating that CNW has evaluated their disclosure controls. They have through 2004 to evaluate their entire internal control structure and release a 10K form stating so (Scenario Two: CareNetWest Companies, Inc., U of P).

With 80 locations throughout the country, this leaves them very little time to ensure that each location is working toward the proper controls. Therefore the timeframe in which their solution must be implemented is almost immediate. This is why one piece of the solution is to bring in teams of external compliant experts to work as the risk managers in this situation. The rationale for this decision is that, without a CRO and an established risk-management team, CNW is in no shape to try to handle this on their own.

Another piece of the solution is that, because CNW are not SOX compliant, nor do they have a roadmap to guide them in becoming compliant, they need to develop a strong and thorough compliance plan for use in future audits. This plan will be followed to develop audit protocols that outline how to proceed in becoming compliant with governance implementation. The protocols, in turn, will generate the reports that will be filed with the Securities Exchange Commission (SEC). The protocol will either be developed by them or by external experts.

In terms of a restructure, there is not time enough within the scope of this compliance project to try to complete an organizational restructure. An effort such as that would take away time and resources that CNW cannot afford. However, a restructure is something CNW should definitely consider once they have become compliant to SOX and have a reporting protocol to follow for each upcoming audit. Proper people conducting the proper functions within the corporation will help to ensure that the compliance protocol is understood and followed, and that financial disclosures will never be a problem for them in the future.

Developing and Implementing the Solution
It is worth the time, money, and use of employee resources for CNW to build a strong plan to carry them through all future audits in order to protect all affected stakeholders. Therefore, the combined solution of hiring an external compliance firm and compliance plan and protocol development will be implemented by the external firm. The rationale for this decision is to ensure that important internal compliance issues are being identified and addressed by sources independent of the organization, and not by internal employees. This also ensures that compliance gaps are being filled by compliance experts who are familiar with the appropriate regulations.

Evaluating the Results
Progress of the chosen solution will be evaluated as follows:
Regular assessments of the success and failures of generated disclosure reports will be conducted. This allows risk managers to identify missing areas within the reports and mitigate as needed. Protocols used to generate the compliance reports will be rewritten as necessary to ensure ongoing compliance.

A master plan for ongoing financial disclosure compliance assurance will be developed. This ensures that all previous failures to meet compliance requirements are captured, to prevent them from happening in future audits and reporting.

Conclusion
CNW is facing a critical challenge when determining not only what within the organization needs to be prepared for upcoming financial disclosure compliance audit reporting, but how compliance is to be achieved. With their limited knowledge of SOX and other disclosure requirements, CNW has found themselves in a dire situation, resulting as a consequence of their lack of interest in previous warnings.

They have lost their CRO, who was their primary source of compliance knowledge. Their Board of Directors has vacancies in three of the most critical areas related to compliance. Their accounting advisor, Dawn Nelson, CPA, who is currently the only source they have to glean any immediate information on corporate disclosure controls is largely unavailable to them due to conflicting interests with the firm that employs her (Scenario Two: CareNetWest Companies, Inc., U of P).
Essentially, the leaders of CNW needed to start at the beginning in understanding, developing, implementing, and ongoing assurance of appropriate compliance disclosure controls within the organization to ensure the protection of all stakeholders involved.

By bringing in external compliance experts to help in their state of need allows for independent review of their existing control system. The development of standard protocols designed to address all areas required by the SOX regulation will help streamline the reporting process and minimize non-compliance issues.

This solution, properly implemented, will bring CNW to the success they diligently planned and will deservedly receive.

References
Biederman, D. Journal of Commerce, 3/27/2006, Vol. 7 Issue 13, p50-52, 3p. Retrieved on June 29, 2006 from the EBSCO database.
Chew, D. H. Jr., Gillan, S. L. Print Corporate Governance at the Crossroads: A Book of Readings, 1e. eBook Collection, University of Phoenix, Copyright © 2005 The McGraw-Hill Companies, Inc.
MBA/560 Read Me First. (2006). Week 4, University of Phoenix white paper. P1, ¶2. Retrieved June 12, 2006 from the University of Phoenix Web site: https://mycampus.phoenix.edu.
Scenario Two: CareNetWest Companies, Inc. Week 4 reading, University of Phoenix (2006). Retrieved June 12, 2006 from the University of Phoenix Web site: https://mycampus.phoenix.edu.
What Is Problem-Based Learning? (2006). University of Phoenix. Retrieved September, 2005 from the University of Phoenix Web site: https://mycampus.phoenix.edu.