Automating Compliance

No one would confuse Crown Media Holdings Inc. with media giants like Time Warner Inc. and Viacom Inc. With only $208 million in 2003 sales, the Greenwood Village, Colo. owner of the family-friendly cable station Hallmark Channel competes for advertising and distribution agreements with some of the best-known corporations in the U.S. Still, over the past year, Crown Media has been undertaking a dogged self-analysis that may, to some degree, reduce the gap between the company and its much larger rivals.

Credit the effort to the Sarbanes-Oxley Act. Passed in the summer of 2002, the legislation sets a series of deadlines for public companies to certify that their financial results are accurate, that all material information is reported in a timely fashion, and that they have ironclad process controls to protect the integrity of their financial data. Otherwise, they risk having their CEOs experience the indignity of a perp walk out of company headquarters. In demanding these guarantees, the act is arguably responsible for the most thorough going facelift among U.S. businesses since the founding of the Securities and Exchange Commission in the wake of the Great Depression.

To accommodate Sarbanes-Oxley, Crown Media, which must produce its compliance report by the end of this year, mapped every major process in its balance sheet used to handle incoming and outgoing revenue and expenses. Much of this data had been consigned to simple, stand-alone, Excel spreadsheets, often without any safeguards to ensure that the numbers weren't tampered with before being consolidated into overall company results. To aid in this effort, Crown Media purchased a software package called Movaris Certainty, one of many programs offered in the wake of Sarbanes-Oxley (others include SAS Corporate Compliance, Oracle Internal Controls Manager and OpenPages' SOX Express).

Crown Media uploaded its Excel data into Certainty, and input the processes used for recording each financial transaction. The software, in turn, produced a hierarchy of preventive controls for every division and for every type of financial activity in the company. With these controls, when there is noncompliance or a possible misuse of internal data—a purchase order filled out by someone not authorized to do so, for instance, or a number changed in an accounts-payable record without sign-off from a chain of supervisors—executives receive an alert that pinpoints the problem and triggers possible disciplinary or mitigating action. "The program is analogous to an IT monitoring system that tracks a network for glitches, intrusions and other anomalies," says Mark Thompson, Crown Media's senior vice president of finance and IT.