Compliance: Is Sarbanes-Oxley Working?

Learning to Live With SOX

It seems like a straightforward enough question: is SOX working? Two years after the Sarbanes-Oxley Act (also called the Public Company Accounting Reform and Investor Protection Act of 2002) went into effect, there is a mounting supply of data on hand to throw at the query. But like so many seemingly simple questions, this one isn’t. There are a lot of layers to peel back before any serious answer can be reached.
The question invites more questions, such as, “What does ‘working’ mean?” “Working for whom?”

And to the extent that SOX might be working, are its successes worth the costs? One thing everyone agrees on is that the costs of compliance are much higher than had been estimated. After that, well, define “worth it.”

One point of view is represented by Stephen Wagner and Lee Dittmar in their article, “The Unexpected Benefits of Sarbanes-Oxley,” published in the April 2006 edition of the Harvard Business Review. They write: “A number of companies have begun to standardize and consolidate key financial processes, eliminate redundant information systems and unify multiple platforms; . . . automate manual processes; . . . better integrate far-flung offices and acquisitions; bring new employees up to speed faster; broaden responsibility for controls; and eliminate unnecessary controls.”

Or not, according to a recent paper by Henry Butler and Larry Ribstein for the American Enterprise Institute, called The Sarbanes-Oxley Debacle: How to Fix It and What We’ve Learned (see “Larry Ribstein on the Holes in SOX”). It calls SOX “a colossal failure, poorly conceived and hastily enacted during a regulatory panic. . . . SOX supporters are dead wrong in their assessment of SOX—both logic and evidence make it clear that SOX was a costly mistake.”

Even quantitative responses, from the number of earnings restatements by public companies since compliance with the law became mandatory (high), to the number of initial public offerings by companies in the U.S. capital markets (low), can be spun in different directions.

And as in so many things, where you stand may depend on where you sit. Groups with particular interests have definite opinions on the question. For audit firms, Sarbanes-Oxley has been called the Full Employment Act of 2002. IT workers with audit skills command a premium in the job market. SOX is working just fine for these folks. But investment bankers who haven’t been getting those tasty IPO fees, and small companies forced to pay big dollars to comply? Not so much.

Of course, business and regulation and markets are complex subjects, and in the real world this question is not a binary function with a clear conclusion—on or off, yes or no. But while acknowledging messy, multifactorial reality, and with some caveats and quibbles, we’ll venture an answer to the question: Is SOX working?
Yeah, it’s working okay. Not perfectly, and not for everyone, but in a broad and measurable sense, the case for SOX is affirmative.

This is a holistic argument. It won’t convince the IPO firms or the folks at the American Enterprise Institute. But as Wagner and Dittmar contend, the benefits of SOX go beyond avoiding scandals to rationalizing financial reporting that had grown ragged for a whole laundry list of reasons, including poor integration of merged companies, Y2K fixes, new technology that doesn’t play nice with legacy systems, and complex, interconnected supply chains. As high SOX start-up costs are absorbed, the real benefits should accrue to companies with standardized processes and centralized systems that make compliance with regulations of all kinds an integral part of their cultures.

As Senator Paul Sarbanes (D–Md.), one of the bill’s cosponsors, said in March, “The benefits of compliance are emerging.” He pointed to a CFO Research Services survey of 180 senior finance executives who identified “unexpected benefits from Sarbanes-Oxley compliance.” Respondents said Sarbanes-Oxley enables them to manage risk better and uncover weaknesses in financial controls, while boosting operational performance.
Let’s walk through some of the pros and cons, the spin and the counterspin. Your mileage may vary depending on usage. I look forward to some full, frank discussion of this issue on my CIO Insight blog, “Know It All” in the weeks to come.

Story Guide: