Talk to any accountant, auditor, or CEO of a publicly traded company in the U.S and he or she will likely have two words at top of mind: Sarbanes-Oxley. Since Congress passed it in July 2002, the 66-page Sarbanes-Oxley Act, or SOX as many call it, has set in motion a whirlwind of activity, as public companies ramp up efforts to meet its new financial reporting standards and pinpoint weaknesses in their internal controls.
With so much at stake—financially, legally, and ethically— it’s no surprise that Sarbanes-Oxley has unleashed a thunderstorm of anxieties among corporate executives. Of special concern is Section 404 under the act, which involves “management assessment of internal controls.” Under Section 404, upper management must not only certify its company’s financial reports, but also take responsibility for any erroneous or misleading statements within them. In the pre-SOX era, for instance, Enron CEO Jeffrey Skilling could make a potentially plausible defense of ignorance of his company’s financial shenanigans. Ousted HealthSouth CEO Richard Scrushy, on the other hand, has a tougher time convincing a jury of his innocence—he personally certified the statements in his company’s misleading financial reports under SOX regulations.
As a result, SOX means more to business than simple legislation, say many analysts. It’s symbolic of what many see as a necessary and difficult shift in how businesses operate—a shift from a “what-you-don’t-know-can’t-hurt-you” attitude at management level to an “honesty-is-the-best-policy” imperative. Moreover, it’s providing a classroom-ready, realtime case study for business schools on what may be a revolutionary moment in business history.
The Costs of Compliance
Section 404 is a mere two paragraphs on page 45 of the Sarbanes-Oxley Act; and yet it’s causing most of the brouhaha in business boardrooms across the U.S. and, in some cases, around the world. It comprises three central issues. First, it requires that management create reliable internal financial controls; second, it requires that management attest to the reliability of those controls and the accuracy of financial statements that result from those controls; third, it requires an independent auditor to further attest to the statements made by management. At all stages, companies are trying to suss out “material weaknesses,” as defined elsewhere in the act. These are deficiencies that could potentially, although not necessarily, result in a misstatement of financial reports.
Complying with those three new standards is easier said than done. Industry estimates put the national cost of compliance— relating most specifically to Section 404—at $35 billion. Most of the money will go to pay for the new IT systems and extra employee time required to put new internal control systems into effect. A survey conducted by Revenue Recognition.com, an online educational resource for financial executives hosted by CFO.com, further breaks down the costs. Respondents from large companies generating more than $1 billion in revenue estimated that their employees would expend more than 12 person-years in labor to comply with the new rules. Those from midsized companies generating $200 million to $1 billion in revenue estimated it would require more than 6.5 person-years. In the same survey, large companies estimated their external auditing costs would increase an average 52 percent, while midsized companies reported an average 81 percent increase.
The Business Roundtable of Washington, D.C., recently released its third annual survey of its 160 members regarding their corporate governance practices. Forty-seven percent of 106 respondents estimate they will pay more than $10 million to implement SOX standards in 2005. Also, nearly onethird of respondents estimated SOX-related costs of $6 million to $10 million.
Already the fallout has begun. Companies such as Eastman Kodak and Toys “R” Us have recently reported “material weaknesses” in their 2004 internal financial controls. And because the cost of compliance is so high, especially for smaller companies with fewer resources, some publicly traded companies are even considering delisting themselves from the U.S. Stock Exchange. So far, several small companies have announced that they have filed Form 15 with the U.S. Securities and Exchange Commission (SEC), which allows any company with 300 or fewer stockholders to take itself off the ticker.
Companies based outside the U.S. also have been weighing the costs of compliance versus the savings of deregistration. The 113 UK-based businesses listed on the New York Stock Exchange and NASDAQ, for example, might pay at least £122 million for SOX compliance, according to a survey by Financial Executives International. As a result, some companies are finding it more affordable to pull out of the U.S. market. Sweden-based Electrolux was among the first to delist from NASDAQ post-SOX. Company representatives said the move made sense because most of its stock trades take place in Stockholm. Still, many analysts believe SOX had much to do with the decision.
In addition, new non-U.S. companies are avoiding the U.S. market altogether. New listings with the SEC from companies outside the U.S. have dropped precipitously—to nearly none—since the act passed in 2002.
“When people say ‘Sarbanes-Oxley will cost a lot,’ they’re really referring to Section 404,” says John Bostelman, a New York attorney and expert on Sarbanes-Oxley. “Section 404 requires companies to document both the results of financial transactions and the processes they’ve used to generate them. A company may have thousands of processes that may work just fine, but up to this point, no one has written them down. Large companies may have to put together enough documentation to fill 20 three-ring binder notebooks.”
Even so, Bostelman believes that the instances of companies deregistering from the SEC should be limited, especially once this fiscal reporting season passes. The SEC, too, is trying to ease the transition. In March, it granted small and non-U.S. companies a one-year extension for filing the appropriate reports, acknowledging that those groups may need extra time and assistance to comply. In the long run, Bostelman predicts most companies will weather the current storm and stay in the market.
Accounting for Education
Not surprisingly, a flood of new informational sources— including books, Web sites, and courses—has entered the market. A number of industry and government organizations have set up online informational sites on Sarbanes-Oxley, including the SEC, the American Institute of Certified Public Accountants, and the Institute of Internal Auditors. With formal educational materials on Sarbanes-Oxley a rarity at the moment, such resources have become vital learning tools for business faculty and students.
For example, after Bostelman wrote the 2,000-page, two-volume Sarbanes-Oxley Deskbook designed for the legal community, he realized that the business community also needed a resource, preferably one less technically presented. He then wrote a new reference guide designed specifically for business managers, PLI’s Guide to the Sarbanes-Oxley Act for Business Professionals, offered through the Practising Law Institute in New York City.
In addition, the Big Four firms—PricewaterhouseCoopers, KPMG, Ernst & Young, and Deloitte & Touche—have collaborated to set up an informational Web site on 404 at www.s-oxinternalcontrolinfo.com. The site includes a Webcast of a media briefing the four organizations held in January, as well as two documents addressing the public’s 404-related questions.
Ray Beier, a partner at PwC, led the company’s National Technical Services Group that was convened to identify and address emerging business, regulatory, and reporting issues. The information on the new collaborative Web site, he says, is part of an effort to make investors comfortable with SOX’s implications. “Section 404 is based on the notion of restoring investor confidence, yet we feared that investors would not be able to understand the reporting that would arise from this model,” says Beier. “It made sense for the four firms to come together to provide information to help investors digest the 404 reporting model.”
A New Corporate Order
Perhaps the most far-reaching effect of Sarbanes-Oxley may be how it transforms the role of the CEO.Over the past few years, industry has moved away from the notion of the CEO as the unilateral decision maker and leader of a company. Instead, CEOs are now accountable to a number of constituents for each decision and each move their companies make.
“These new rules have essentially ended the days of the imperial CEO,” says Bostelman. “The CEO now has a boss, and that boss is the board.” Moreover, the board also has a boss—the audit committee. And the audit committee’s boss? The newly formed Public Company Accounting Oversight Board (PCAOB), established by the SEC to make sure the auditors, too, are completely accountable. The PCAOB began this year to evaluate and review the work of internal control auditors, to ensure everything’s on the up-and-up. As a result, auditors must be especially vigilant to comply simultaneously with management directives, stakeholder expectations, and the PCAOB’s watchful eye.
The roles of other employees further down the ladder also will change as a matter of course. With the necessity of financial reporting flowing throughout organizations— often from the bottom up, rather than from the top down— most of a company’s employees will have at least some responsibility in making the internal controls process as efficient and effective as possible.
“Business managers will need more background in accounting than they needed before,” says Bostelman. “Sarbanes-Oxley has made business much more accountable— and life much riskier—for all managers.”
Just how Sarbanes-Oxley will affect business in the long term is still uncertain. Some in the business community believe the act forces companies to spend exorbitant time and resources on the minutiae of their operations—resources that might be better spent on innovation and strategy. Others, however, believe that while SOX presents its challenges, it may prove to have long-term benefits for publicly traded companies. Once companies have survived this first year under the new regulations, say SOX optimists, many will uncover material weaknesses that otherwise would have gone undetected. They will document their processes and perfect their internal controls. Over time, managers, accountants, and auditors will address any weaknesses, streamline their business processes, and develop a clearer understanding of all aspects of their companies’ operations.
“Top management has traditionally had a low appreciation for internal controls,” says Beier of PwC. “Instead, they’ve encouraged a culture where driving toward the bottom line was paramount. Companies have essentially had a policy of deferred maintenance on their business processes, cobbling together their operations. Those kinds of environments have been historically at high risk for a train wreck.”
“From the corporate scandals, we now realize that accounting was too rules-based, where it needs to be more principles- or objectives-based.”
—Ray Beier, PricewaterhouseCoopers
While the initial costs of Sarbanes-Oxley are high, Beier predicts that its long-term benefits of improved operating efficiency for companies will translate into substantial cost savings down the road. “Administrative systems were generally an afterthought; 404 is making them a priority,” says Beier. “Companies are realizing that their controls were not as strong as they thought, and they’re doing a better job setting them up. They understand the importance of having well-controlled businesses.”
This new order means that all business students—not just accounting majors— will need some knowledge of Section 404-based internal controls and financial reporting. Sarbanes-Oxley may gradually require students to expand their learning to include fields they once might have considered on the periphery of their education. Accounting students, for example, may need to know more about finance, business processes, and management; management students may need to know more about IT; and students in IT and other disciplines may need to know more about accounting.
Beier emphasizes that it has become more important than ever for business schools to cross boundaries between disciplines, to give students a full picture of corporate operations. Business schools need to teach future accountants more than just how to interpret a company’s financial results, he says. They need to teach students to understand the economic costs and benefits of making business decisions. “From the corporate scandals, we now realize that accounting was too rules-based, where it needs to be more principles- or objectives- based,” says Beier. “Business schools have generally done a poor job of ensuring that accounting students understand finance.”
Sarbanes-Oxley has also taught everyone—from CEOs to accountants to business faculty and students—the importance of knowing how the entire company works, Beier adds. “We’ve learned that everyone needs a broad understanding of business processes,” he says. “Business schools have always addressed this issue, but now the need is intensified. Business schools must ensure that students have a deeper appreciation of the details of business processes than they may have had before.”
Such an overarching appreciation will undeniably become crucial as companies move into an age of greater transparency. And despite their current confusion about the new legislation, most business leaders see the most prevalent effect of Sarbanes-Oxley with acute clarity: Whether they’re CEOs or CFOs, IT specialists or department managers, accountants or auditors or board directors, workers in the post-SOX world must make diligent surveillance, operational awareness, and understanding of internal controls absolute priorities. Sarbanes-Oxley and Section 404 have made that a new fact of business.