Executives praise SOX but seek changes; it's not quite a backlash, but after the first full year of reporting under the Sarbanes-Oxley Act, many business leaders are seeking changes.

Almost everyone agrees that the Sarbanes-Oxley Act (SOX) was a necessary and useful piece of legislation that helped restore faith in U.S. companies and their financial statements. But while no one disputes the benefits, business leaders have been complaining loudly that the costs associated with Section 404 compliance are higher than expected and an undue burden.

Passed by Congress in 2002 in the wake of the Enron and WorldCom scandals, SOX requires firms to vouch for accounting controls and disclose weaknesses to shareholders. Section 404 of the act took effect this year for U.S. companies with revenue of $75 million or more. It requires management to assess the effectiveness of internal financial controls and instructs auditors to report on whether the controls are adequate or have material weaknesses.

Some companies have complained about a big increase in what they consider unproductive auditing expenses, and business lobbyists are pushing to amend the rules. Critics contend SOX may be making executives too cautious, hindering business expansion and job growth.

Such complaints from businesses about the costs of compliance prompted U.S. auditing regulators in May to move to ease the expenses. However, regulators also said that the law has greatly benefited investors, and there is no need for Congress to revise it at this time.

Yet the complaints and the calls for changing the rule have not stopped.

Why All the Criticism?

The U.S. House Committee on Financial Services held an April 21 hearing to review the impact of SOX on businesses. Former Securities and Exchange Commission (SEC) Chairman William H. Donaldson (he resigned June 2) and Public Company Accounting Oversight Board (PCAOB) Chairman William J. McDonough testified before the committee.

"Nothing is more central to sound financial reporting than the strong internal controls contemplated by Sarbanes-Oxley. I may have heard a complaint or two about the costs, but the benefits have not been disputed," said Committee Chairman Mike Oxley. "And make no mistake, the costs associated with Section 404 are higher than anyone expected. That is a cause for concern. I am particularly sensitive to any undue burden on small and mid-size companies, whose compliance costs are a higher percentage of total revenues." (Smaller U.S. firms and foreign companies will have to comply with the law beginning in mid-2006.)

Donaldson agreed that the internal control reporting and auditing requirements require significant time and expense. "We expect that the short-term costs to improve internal control over financial reporting will, over the long-term, result in structurally sounder corporate practices and more reliable financial reporting," he said. "With these critical goals now firmly in view, calls to roll back or weaken Sarbanes-Oxley generally as a result of concern over the costs of internal control reporting are, in my judgment, unjustified."

According to Donaldson, about 200 companies--out of 2,500 that had filed their internal controls reports with the SEC by the end of March--found material weaknesses in controls, and several of those have discovered errors in their financial statements caused by those weaknesses. He said this is an indication that SOK is addressing a real problem.

McDonough said 79 percent of 222 financial executives recently surveyed by Oversight Systems reported that complying with Section 404 has strengthened their business' internal controls.

But many companies have complained that the compliance costs are too high and that auditors force them to go through expensive procedures that accomplished little. A survey of 217 companies by Financial Executives International, a networking and advocacy organization, found that the average cost of 404 compliance is $4.4 million.

The complaints have been so loud that Rep. Ron Paul (R-Texas) proposed in April to eliminate Section 404 entirely. In a statement, he said the provision "has raised the costs of doing business, thus causing foreign companies to withdraw from American markets and retarding economic growth."

Section 404 directs the SEC to adopt rules requiring each annual report of a publicly traded company, other than a registered investment company, to contain the following two provisions:

1) A statement of management's responsibility for establishing and maintaining an adequate internal control structure and procedures for financial reporting

2) Management's assessment, as of the end of the company's most recent fiscal year, of the effectiveness of the company's internal control structure and procedures for financial reporting

Section 404 also requires a company's auditor to attest to and report on management's assessment of the effectiveness of the company's internal controls and procedures for financial reporting in accordance with standards established by the SEC's Public Company Accounting Oversight Board (PCAOB).

In mid-April, the SEC held a roundtable discussion in Washington, D.C., to review the internal control provisions of Section 404. SEC commissioners, PCAOB members, and senior SEC and PCAOB staff listened to panelists--including representatives from publicly traded companies and audit firms, as well as individuals who chair audit committees for large corporations and investment fund managers--to hear the opinions of organizations that have gone through the audit process and to learn how it can be improved.

Panelists said SOX and Section 404 have changed the culture of reporting and made it more transparent. While most agreed the law was "necessary to restore investor confidence," they also pointed out that the cost of compliance has increased.

Executives at the roundtable consistently said that complying with Section 404 has been more expensive than they had anticipated, and they questioned whether the benefit--which no one has been able to quantify as of yet--is worth the cost.

Analyst firm IDC predicts that the worldwide information management compliance market will be worth $20 billion by 2009. E-mail archiving applications alone cost businesses $180 million last year; IDC found a sharp increase from the $33 million spent in 2003.

A recent survey of 90 clients of large accounting firms Deloitte Touche Tohmatsu, Ernst & Young, KPMG, and PricewaterhouseCoopers found that the companies spent an average of $7.8 million on compliance last year--about 10 percent of their revenue. But, according to the New York Times Sunday Business section, this is less than the $9.8 million paid, on average, to CEOs at 179 companies whose annual filings were surveyed earlier this month.

The accounting firms noted that as companies become more familiar with Section 404, the amount they spend to comply with it may drop this year by as much as 46 percent, according to the survey.

SOX Causing Filing Delays

In the meantime, dozens of companies have delayed filing their financial reports because of corporate-governance regulations, according to the Associated Press.

Almost 80 companies with annual revenue of more than $100 million recently notified the SEC that they would need more time to complete their quarterly reports--more than twice the 36 companies of that size that reported delays in the first quarter of 2004, according to San Francisco research and proxy-advisory firm Glass Lewis & Co.

Many of the late companies have missed other filing deadlines, and more than half delayed their financials because of internal control issues or financial restatements, according to Glass Lewis.

The recent increase in late quarterly reports follows a deluge of delayed annual reports for 2004. Hundreds of companies missed the annual deadline --May 10 for large companies with quarters ending March 31--earlier this year as new accountability requirements became effective under SOX.

The Associated Press reported that an additional 14 large companies delayed their quarterly financials in May because they were still working on their internal control reviews for 2004 or the), were fixing problems found during those reviews. At least 29 companies also postponed filing their quarterly reports because they were in the process of, or had just finished, restating past financials. According to Glass Lewis, only 10 companies delayed their restatements one year ago.

SEC Interprets the Rules

The SEC is listening to the complaints. In May, the SEC and PCAOB issued new guidance to auditors that urged more flexibility in applying the rule and interpreted the rules in ways that it said will cut costs. At the same time, according to the Times, SEC Chief Accountant Donald T. Nicolaisen issued a staff report explaining the SEC's views on 404 and urging auditors to use their judgment to reduce the checks they perform. McDonough told the Times that, in some cases, too much work had been done to verify companies' financial statements. However, he said, with the new clarifications of the rule there is no need for congressional action to modify SOX, as some companies have requested.

Officials would not estimate how much costs would decline, but said that the savings could be significant. "As management and auditors gain more experience, I expect the process will be increasingly more effective, focused, and cost-efficient," Nicolaisen told the Times. "Judgment will improve over time."

In its report, the SEC strongly urged companies with financial weaknesses to give investors information to assess how important each weakness really is, "distinguishing those material weaknesses that may have a pervasive impact on internal control over financial reporting from those material weaknesses that do not."

The report provided a somewhat relaxed definition of what is "material" in deciding whether a weakness needed to be reported at all. It said businesses should determine materiality based on annual totals for the entire company, not on the impact an item might have on a quarterly report or on results of one part of the company. But in some cases, as when one or two parts of a company are critical to investors, the definition of "material" would need to be expanded.

Many have accused SOX of inhibiting communications between auditors and companies. Some companies complained that auditors rejected tests of controls done during the fiscal year and said that all tests must be done again at the end of the year. The staff report said that in many cases it was wise to use tests done during the year, and it emphasized the need for judgment. The auditing board added that financial controls should be integrated with the normal audit of the company's financial statement, which it said would bring down costs.

In addition, companies are often unwilling to give auditors copies of preliminary financial reports, fearing that errors will be found and considered clear evidence of ineffective controls; auditors are sometimes hesitant to offer advice on accounting or control issues out of fear that this would compromise their independence when they later audit the company.

According to the Times, the SEC and the PCAOB report offered reassurance: "The auditor's discussing and exchanging views with management does not in itself violate the independence principles," the report said. "The staff supports a strong audit profession where a hallmark of its professionalism is to exercise sound judgment in both the audit and in ongoing dialogue with management."

McDonough said the SEC would consider ways to provide more guidance on 404 requirements in the next few months.

Changes Would Be Premature

By all accounts, federal regulators say changes to the rules, and to SOX, would be premature. It has only been one year, and the benefits are just starting to be realized. In almost any new undertaking of this scale, the first year is always difficult from a cost perspective.

Regulators advise companies to work with the new reporting requirements and not try to change them at this point. After all, SOX was passed in response to several large corporate fraud cases, and executives may be hard pressed to find investors who will empathize when they complain about the cost of compliance. Ill

References

Acohido, Byron. "Greenspan Lauds Sarbanes-Oxley." USA Today, 16 May 2005.

Associated Press. "Update 1: Firms Delay Filings Amid Sarbanes-Oxley," 17 May 2005.

Best, Jo. "Stress, Job Insecurity and No ROI: Compliance for CIOs." silicon.com, 22 March 2005.

Committee on Financial Services. "The Impact of the Sarbanes-Oxley Act," 21 April 2005. Available at http://financialservices.house.gov/hearings.asp?formmode=detail&hearing=376 (accessed 6 June 2005).

Glater, Jonathan D. "Here It Comes: The Sarbanes-Oxley Backlash." New York Times, 17 April 2005.

Norris, Floyd. "Regulators Seek to Trim Cost of Rules on Auditing." New Fork Times, 17 May 2005.

Nikki Swartz is a freelance writer based in Kansas City, Mo., and former Associate Editor of The Information Management Journal. She may be contacted at [e-mail].