Sarbanes-Oxley 2005: reality and relief.

Compliance with provisions of the Sarbanes-Oxley Act of 2002 continues to claim huge amounts of time and resources of companies, auditors and regulators. And, as the first full reporting season under Sarbanes-Oxley concludes, signs are beginning to indicate that a move towards a more stable and rational environment is pending.

A few reasons for this reality and some relief that is in sight are high-lighted here.

Real or perceived drastic events result in drastic measures, and the nine-month period that ended with the passage of Sarbanes-Oxley was no exception. Those events, from November 2001 to June 2002, include: Enron Corp. restated earnings for the past five years, reporting $586 million in losses; Adelphia Communications Corp. stated that $2.3 billion borrowed by the Rigas family was not on its books; Tyco International Ltd.'s CEO was indicted on tax evasion charges; ImClone Systems Inc. CEO Samuel Waksal was arrested on insider trading charges; and WorldCom Inc. admitted to inflating earnings by $3.8 billion.

It should come as no surprise that U.S. elected officials and the Securities and Exchange Commission (SEC) aggressively pursued correction of the problem. In the aftermath, however, many have claimed that the resulting regulation is overly burdensome, especially for smaller companies. Yet, we are hard-pressed to find a truly legitimate argument against a single one of the Act's goals or its chosen methods of reaching those goals.

Management should take ownership of the processes that create its public financial statements, and it should be able to demonstrate why it believes its financial statements are correct. Auditors should be independent of the financial statements that they audit, and investors should be able to see evidence that all of the above is happening correctly.

The real problem isn't Sarbanes-Oxley, but rather a lack of recognition from the beginning that real and comprehensive changes would be required in the ways public companies execute their financial reporting processes. That lack of recognition has led to a misunderstanding about the amount of time and expense that would be required to affect those changes--which is where we are today.

In June 2003, the SEC estimated that the total cost of implementing Section 404 (excluding the cost of having to obtain a related auditor's opinion) would be approximately $91,000 per company. This estimate was based, at least in part, on a partially correct assumption that most of the things being required by the Act were already requirements, and as such, should not take a tremendous amount of time to prove. For example, management has always been responsible for the financial statements. CEOs and CFOs have been signing representation letters to their auditors for years saying: "We confirm that we are responsible for the fair presentation of our financial statements in conformity with generally accepted accounting principles (GAAP)."

In reality, however, very few of those letters were backed up by solid and documented processes and controls that management could truly say they knew were working properly. Management relied on good-hearted, knowledgeable people and their auditors to get the number right.

Which brings us to the second false belief: that the auditors were completely independent from the financial statements they were auditing. This concept was certainly true prior to Sarbanes-Oxley, regarding routine areas of accounting, but when it came to complex accounting issues, like it or not, the auditors were very often the ones determining what the correct accounting should be. Whether it was tax accounting or derivatives, or acquisitions or valuing stock options, the auditors often had a heavy hand in determining the right debits and credits. In fact, many companies left those areas of their books opened until the auditors could complete their audit work and tell them the correct answer. Whether that process was flawed or not is perhaps worthy of discussion, but the reality is that in those complex areas, the auditor was often auditing its own work.

So, herein lies the challenge. First, management needs to document, test and prove why it believes it has good financial reporting procedures in place, and management needs qualified bodies to help do this. In fact, most really need an internal audit department to monitor this on a regular basis.

Second, companies have to fill the accounting holes left when the auditor could no longer help them get the complex debits and credits right. In fact, not only do they have to find a qualified resource to perform some of these complex accounting calculations, but they also have to find someone qualified to review them to make sure they are accurate. And, with the Public Company Accounting Oversight Board (PCAOB) and the SEC hiring qualified professionals for oversight roles and the auditors hiring more people to audit internal controls, the pool of qualified resources has been tapped dry. I believe it is going to take the accounting profession at least five years to train enough professionals to be able to execute and oversee effective accounting for public companies.

Questioning the 'Fix'

While many are questioning, "If it wasn't really broken before, why go to all this effort and expense?" I would point out one statistic to prove that it was truly necessary. Sarbanes-Oxley mandated that the Government Accountability Office (GAO) conduct a study of public company misstatements that resulted from error or fraud. Looking at 919 restatements by 845 public companies in the 66-month period between January 1997 and June 2002, the GAO calculated that those restatements caused the loss of $100 billion of market capitalization. That equates to $1.5 billion per month of investors' money being lost due to financial reporting errors or fraud. While Sarbanes-Oxley may be costing more than the $91,000 per company originally estimated, it's nowhere near $1.5 billion per month!

[ILLUSTRATION OMITTED]

That said, the short-term burden has been excessive. Accelerated filers have had modest relief through minor extensions in the effective date of Section 404 and the deadlines to get their audited internal control assertions filed. However, most could rightfully argue that they should have had some additional time. Nonetheless, it appears that nearly 90 percent of accelerated filers will have clean opinions on their internal controls in connection with their 2004 audits. The cost has been extreme, but the worst is behind them and there should be no doubt that their financial reporting processes, as a whole, are stronger.

Non-accelerated filers now have the tremendous advantage of not being on the "bleeding edge." For most of them, Section 404 will not be effective until the end of their 2006 fiscal year. As a result, they will have a great opportunity to learn from those brave souls who went before them. In addition, the Committee of Sponsoring Organizations (of the Treadway Commission), known as COSO, is in the process of developing example guidance, due this summer, to help smaller public companies implement the COSO framework in a way that does not treat them like multi-billion-dollar companies.

Additionally, an SEC-sponsored committee is evaluating the impact of Sarbanes-Oxley on smaller companies. And, all should gain some benefit from results of the SEC's mid-April roundtable (information on this not available at press time). Finally, the auditing profession will, hopefully, spend some quality time debriefing on the first 404 audit cycle to improve the efficiency and effectiveness of the 404 audit process.

Sarbanes-Oxley is here to stay, and over the next several months and years, we involved in the process will, no doubt, move towards improving the expectations and the requirements so that everyone is treated proportionally equal.

Contributed by Trent Gazzaway ([e-mail]), Managing Partner of Corporate Governance for Grant Thornton LLP. Published in CorporateGovernor, Winter/Spring 2005, by Grant Thornton, this article was edited and is used with permission.

by Ellen M. Heffes