1. © 2004 Ceridian Corporation. All rights reserved. Corporate Integrity and The Sarbanes-Oxley Act Victoria Nemerson Vice President Compliance, Ceridian Lynn Brewer President, The Integrity Institute, Inc.

2. © 2004 Ceridian Corporation. All rights reserved. Agenda & Learning Objectives Sarbanes-Oxley Act: How did we get here and what does it mean for your organization? Disclosure Controls: Prevention & Detection of Fraud and Abuse Confessions of an Enron Executive How to Minimize Your Risk: Ten Best Practices and A Strategy for Compliance

3. © 2004 Ceridian Corporation. All rights reserved. Sarbanes-Oxley Act: Officers & Directors Section 402: Bans loans to officers & directors Section 403: Shortens due dates for reporting transactions Section 304: Disgorge bonus & incentives Section 306: Blackout periods

4. © 2004 Ceridian Corporation. All rights reserved. SOX & Disclosure Controls Section 302  CEOs and CFOs certify they are responsible for “disclosure controls & procedures.”  Disclosure Committee – SEC  Quarterly Reports – Internal Controls  Significant changes & other factors  Corrective actions

5. © 2004 Ceridian Corporation. All rights reserved. SOX: Internal Controls Over Financial Reporting Section 404  Internal controls over financial reporting  Quarterly reports – material changes  Reasonable assurances:  Detail accurately & fairly reflects transactions  Transactions are recorded GAAP  Prevention & detection of material effects on financial statements.

6. © 2004 Ceridian Corporation. All rights reserved. SOX: Code of Ethical Conduct Section 406 Written standards reasonably necessary to deter wrongdoing and promote:  Honest & ethical conduct;  Accurate & timely disclosure public reports;  Compliance with the law;  Internal reporting of code violation; and  Accountability for adherence to code

7. © 2004 Ceridian Corporation. All rights reserved. SOX: Stock Exchange Governance SEC governance requirements: Director Independence Rules; Audit committee and other board committee composition; Director education and training; Corporate governance guidelines; and Code of business conduct and ethics

8. © 2004 Ceridian Corporation. All rights reserved. SOX: Reporting Tool Section 301 To establish procedures for the receipt, retention and treatment of complaints and the confidential, anonymous submission by employees Regarding: Accounting Internal controls Auditing matters

9. © 2004 Ceridian Corporation. All rights reserved. SOX: Whistleblower Protections Section 806 gives employees a right to sue their employer for retaliation.  Employees must file a charge with US DOL  OSHA has 180 days to investigate and resolve  If not resolved, employee has COA Section 1107 provides for criminal penalties  Includes up to 10 years in prison for retaliation

10. © 2004 Ceridian Corporation. All rights reserved. Confidential Reporting Systems Reporting Systems must be:  Free of Conflict  Anonymous  Universally Accessible and Available Non-financial Incident Reporting:  Discrimination/Harassment  Misconduct/Inappropriate Behavior  Alcoholism & Substance Abuse  Workplace Violence/Threat  Theft

11. © 2004 Ceridian Corporation. All rights reserved. Confessions of an Enron Executive

12. © 2004 Ceridian Corporation. All rights reserved. How would you know? How would you discover? Do you have knowledge? Should you have knowledge? Are you on notice?

13. © 2004 Ceridian Corporation. All rights reserved. Prevention Changing Cultural Paradigms 75% of the workforce may have something to share but don’t report because of fear of retribution or retaliation. (AICPA’s Report to the Nation 2002)

14. © 2004 Ceridian Corporation. All rights reserved. FALSE PROPHET$ “We have found that companies that have a written vision and values statement have a far greater Return On Investment than those that don’t.” Jeff Skilling, Enron President All Employee Meeting (April, 1998) Launch of New Vision & Values

15. © 2004 Ceridian Corporation. All rights reserved. It was obvious to those Outside too... “According to the Beneish Model, Enron may be manipulating its earnings.... We recommend a sell on Enron stock.” Graduate students (Cornell University) May 5, 1998

16. © 2004 Ceridian Corporation. All rights reserved. For anyone willing to look... Enron’s 2000 Shareholder Letter “Enron’s performance in 2000 was a success by any measure... The company’s net income reached a record $1.3 billion in 2000.” $1.3 billion is not reported in the audited income statement several pages later. The net income reported is $979 million.

17. © 2004 Ceridian Corporation. All rights reserved. Enron’s Management Incident Report

18. © 2004 Ceridian Corporation. All rights reserved. Enron’s Hotline by Classification of Allegation

19. © 2004 Ceridian Corporation. All rights reserved. Enron’s Hotline Method of Reporting

20. © 2004 Ceridian Corporation. All rights reserved.

22. What do Regulators, Prosecutors and Judges expect? Diligent Effective Industry Practice

23. © 2004 Ceridian Corporation. All rights reserved. DOJ Test for Effectiveness Whether a company exercises due diligence is determined by a 7-part inquiry – hence, the 7 hallmarks of an effective corporate compliance program.

24. © 2004 Ceridian Corporation. All rights reserved. Due Diligence Requires: 1. Written set of compliance standards; 2. Appointment of high-level personnel oversight; 3. Discretionary authority not be delegated; 4. Systems for communicating the standards and procedures; 5. Monitoring, auditing, and reporting criminal or unethical conduct, including reporting by employees without fear of retribution; 6. Consistent enforcement of standards through discipline. 7. History of appropriate responses to identified offenses, including preventive action as needed.

25. © 2004 Ceridian Corporation. All rights reserved. Revised Principles 5 Key Considerations: 1. Company’s history of wrongdoing; 2. Its response to regulatory actions; 3. Its reaction to criminal conduct committed by its employees; 4. Level within the corporation; 5. Pervasiveness of criminal behavior within organization.

26. © 2004 Ceridian Corporation. All rights reserved. Ten Best Practices 1. The Auditing committee establishes a procedure for handling complaints about accounting and auditing matters that is anonymous and confidential. 2. The BOD’s Audit Committee is comprised of independent Board Members. 3. One member of the Audit Committee must be a financial expert.

27. © 2004 Ceridian Corporation. All rights reserved. Ten Best Practices 4. The Company’s auditing firm should not perform any non-audit services while performing the audit. 5. All financial disclosures should reflect correcting adjustments and any off balance sheet transactions. 6. The CEO and the CFO must review and sign all annual and quarterly reports to the SEC.

28. © 2004 Ceridian Corporation. All rights reserved. Ten Best Practices 7. No corporate loans to executives. 8. All insider stock transactions must be disclosed within 2 days. 9. Management must assess the effectiveness of internal controls and procedures and these must be certified and signed off by a CPA. 10. Adopt a company wide code of ethics and publish it frequently to all employees (SO: requires to Sr. Exec’s)

29. © 2004 Ceridian Corporation. All rights reserved. Questions?