Sarbanes-Oxley on hot seat: will it work and how does it affect Mexico?

Most large corporations need the investing public to provide them with financing.

Their shares are bought and sold in stock markets, and the investing public will buy the shares they think will bring them the highest returns.

The value or price of the share is determined by how a company is doing at a given moment. And firms produce financial statements, independently certified by an external auditing company, to inform the public of their progress.

Most major multinationals sell their shares in the United States, including major Mexican-based corporations, and 1 in every 2 adult U.S. citizens trade on the stock markets.

This makes the U.S. share market very competitive, and there is tremendous pressure on companies to increase, or at least maintain, the value of their shares. They do this by putting their best face forward.

But the financial statements corporations use to back up their share price may range from the whole truth to a pack of downright lies.

In the United States, the regulatory body that oversees the public share market is called the Securities and Exchange Commission (SEC). The SEC exists to ensure that all financial statements presented by share offerers to the U.S. public are properly and legally prepared.

And the 2002 Sarbanes-Oxley Act (SOX) extends the SEC's regulatory powers.

Born From A Crisis

SOX was born out of a crisis, just as the SEC itself once was. The SEC was created soon after the Wall Street Crash of 1929, while SOX came on the scene soon after the crashes of Enron, WorldCom and the external auditing company Arthur Andersen.

Toward the end of the last century, many large U.S.-based multinationals began to experience financial difficulties. Most rode out the storm and reported the difficulties within their financial statements. A few decided differently, including Enron and WorldCom.

Both companies produced false financial statements to cover up their financial woes. At the very least, Enron and WorldCom deceived their outside auditors Arthur Andersen into thinking they were making profits when in fact they were losing money heavily. At worst, both companies persuaded Arthur Andersen to participate in their financial statement frauds.

Once Enron and WorldCom got past their auditing gatekeepers they were able to deceive the SEC and the whole world. When the truth eventually leaked out, their share prices plummeted and both corporations went into bankruptcy.

Arthur Andersen was barely recovering after Enron when WorldCom came along, acting as a deathblow to the accounting firm. Thousands lost their jobs; millions lost their investments. And the sheer scale of public outrage prompted the U.S. Congress to introduce the SOX act.

Will SOX Work?

In the early 1930s, the SEC was created to protect the U.S. public from corporations and individuals that deliberately lied in order to attract investors.

At that time, the U.S. investing public was crying out for a gatekeeper institution that would mitigate the risk of their investing in fraudulent projects.

The challenge for the SEC is that investment projects that eventually turn fraudulent often start out honestly. Even the most notorious investment fraud of all, the infamous Ponzi scheme, started life in good faith.

Charles Ponzi was an impoverished Italian post-World War I immigrant to the United States when he saw an opportunity he genuinely thought was worth investing in.

After the war, some European countries began issuing and selling postage stamps to finance reconstruction. Ponzi began buying and selling stamps. He initially turned a profit so he sought outside investors. He promised huge short-term returns he genuinely believed he could pay.

[ILLUSTRATION OMITTED]

The stamp business soon turned sour and Ponzi found himself in trouble. Rather than admitting he could not meet obligations, he decided to repay his investors. In order to get money to pay the initial investors, Ponzi sought more investors, promising even higher returns.

The new investors saw the huge dividends paid out to the first investors so they thought they were onto a good thing. Most of the initial investors also reinvested. Soon Ponzi forgot all about the postage stamps and concentrated all his efforts in persuading people to invest in nothing for huge returns. It went on and on, new investors paying off previous investors and, of course, paying for Ponzi's fabulous lifestyle.

Since the SEC was founded, two tools have been used to prevent people like Ponzi from soliciting investment funds from the U.S. public.

The principal tool was that corporations were mandated to contract independent external auditors to verify that financial statements were true. A secondary tool was that corporations seeking public investment were required to send their quarterly and annual financial statements to the SEC.

And until Enron and WorldCom came along the system worked well.

Ponzis For The 21st Century?

The problem was not only the scale of the debacle, but that Enron and WorldCom easily surmounted the principal SEC safeguard--independent assessment of the financial statements by the external auditors.

There was a strong perception within U.S. public opinion that not only did Enron and WorldCom succeed in duping Arthur Andersen, but they also actually succeeded in co-opting the external auditors into their fraudulent schemes.

When forensic accountants and fraud examiners combed through Enron and WorldCom they discovered the relationship both companies had with Arthur Andersen was altogether too cozy.

The external auditing company was providing both Enron and WorldCom with all sorts of services that had nothing to do with the external audit--something that at the time was perfectly legal. But something had to be done about this.

SOX attempts to address the duping/co-opting issue through mandating external auditors to limit their services to each client to external auditing or other services, but not both.

In other words, an external auditing company providing external audit services to a public corporation cannot provide other consulting services to the same client.

In this way, SOX attempts to limit the commercial relationship between a publicly quoted corporation and its independent external auditors. It limits the commercial relationship, but it does not eliminate it.

Corporations must still pay an external auditing company to perform the audit, and some would argue that as long as the external auditors continue to be paid by the company being audited, they can never be truly independent.

Blind Leading The Accountants

Another issue highlighted by the Enron and WorldCom financial statement frauds was that their CEOs insisted they didn't know what was going on. They blamed lower-level employees.

[ILLUSTRATION OMITTED]

We all know the reply of any good accountant when asked what 2 plus 2 is: "What would you like it to be?" The implication is that an accountant will declare 2 plus 2 is 10, if requested to do so by the boss.

SOX addresses the "no clue what was going on" defense by mandating all CEOs and CFOs to sign-off on quarterly and annual financial statements sent to the SEC. SOX also mandates heavy jail time for signing off on falsified financial statements.

Will this work? It certainly ups the ante. However, there is little doubt we will one day see a CEO getting cuffed by the FBI, screaming to the cameras "I know I signed off on those financial statements, but I still had no clue what was going on."

It is a commonly held belief that the financial statement fraud that occurred in Enron and WorldCom was due to weak internal controls. But this is a myth.

The internal controls over financial reporting in place at Enron and WorldCom were excellent. What occurred at both companies was that top management overrode the internal controls.

Fraud is more likely to occur in a company with weak internal controls, but this applies to all frauds except financial statement fraud. Internal controls over financial reporting will only function well in preventing financial statement fraud when they are allowed to, because the perpetrators are usually in a position to command their underlings to ignore such controls.

SOX addresses the supposed weak internal control issue by mandating all publicly quoted companies to perform a yearly review of their internal controls over financial reporting.

SOX further requires the external auditor's certification of management's review. Will this measure be effective in preventing financial statement frauds in the future? As a forensic accountant and fraud examiner, I am convinced it will have little or no effect.

The financial statements Enron and WorldCom presented were not a pack of lies. The final profit figures they came up with were the big lie.

Top management decided to manipulate a few accounts to come up with the final results they desired. It was a bit like asking the accountants 100 times what is 2 plus 2. Ninety nine times out of 100, they came up with 4 as the correct answer. Once in 100 times, they came up with 10 as the false answer.

What this means is that in the cases of Enron and WorldCom, most of the financial reporting was done correctly. So the internal controls over financial reporting had to be functioning correctly.

That little part of the financial reporting that was falsified and that had such enormous consequences was not a result of poor internal controls. It was a result of top management overriding internal controls and manipulating a limited number of accounting entries.

Obeying The Rules

The issue, therefore, should not be internal control of financial reporting, but rather corporate governance and top management's adherence to internal controls.

There are thousands of public corporations currently spending millions of dollars in reviewing their internal controls over financial reporting. And they are spending further enormous sums for their external auditors to review their review.

SOX does attempt to address the corporate governance issue by requiring external auditors to report to the audit committee rather than to top management.

This sounds like the audit committee is being given some teeth. But who controls the audit committee's budget? Will the CFO continue to control the checks going out to the external auditors? What is likely to happen when it comes to hiring and firing the external auditors? The audit committee chairperson will likely approach the CEO to ask for the CFO's recommendation.

Another attempt to address the management override issue is the SOX mandate to all publicly quoted companies to allow their employees the opportunity to access a confidential fraud reporting mechanism.

The SOX measure requires the confidential reporting mechanism, also known as a fraud hot line, be overseen by the audit committee and not top management.

The thinking behind this measure is--would one or more of the lower-level employees at Enron and WorldCom have blown the whistle sooner if they had had the opportunity? I am convinced they would have. Most beancounters resent being asked by their boss to say 2 plus 2 equals 10.

The eventual whistle-blowers at WorldCom were their own internal auditors, who were likely tipped off by a lower-level financial employee.

Under current corporate governance practices, the chief internal auditor reports to the CFO or CEO. It was a miracle at WorldCom that the internal auditors eventually blew the whistle.

The U.S. public would have been well served if SOX mandated all public corporations to have an internal audit area. It would have been doubly well served if SOX mandated the head internal auditor to report directly to the chairperson of the audit committee. Then the internal auditors really would be looked upon as the enemy.

And after Enron and WorldCom maybe that would not be such a bad thing.

SOX Fallout In Mexico

SOX applies to all Mexican corporations that are subsidiaries of any corporation whose shares are quoted in the United States. There are three main categories:

* Mexican subsidiaries of U.S.-based corporations quoted on the U.S. stock market, e.g. General Motors de Mexico, if its U.S.-based General Motors parent company quotes its shares in the United States.

* Mexican subsidiaries of internationally based corporations quoted on the U.S. stock market, e.g. Volkswagen de Mexico, if its German-based Volkswagen parent company quotes its shares in the United States.

* Mexican subsidiaries of Mexican-based corporations quoted on the U.S. stock market, e.g. Barcel, if its Mexican-based parent company Bimbo's shares are traded in the United States.

When SOX first came out, some non-U.S.-based multinationals immediately cried foul. Many European commentators complained the United States was attempting to breach their sovereignty through the application of an extra-territorial law.

It was quickly pointed out to European corporations if they wanted to enter the United States to look for financing they would have to abide by U.S. laws.

The extra-territorial issue has recently been brought to the fore in Mexico as a result of a SEC investigation into the dealings of major broadcaster TV Azteca. Newspaper columnists have questioned the SEC's right to investigate the Mexico City-based conglomerate. The SEC's reply is that TV Azteca is quoted on the U.S. stock market.

SOX mainly addresses financial statement fraud such as that which occurred at Enron and WorldCom. The TV Azteca case does not involve financial statement fraud at all. It would be better described as an accounts payable fraud. The key points of the case appear to be as follows:

* TV Azteca owns some 45 percent of a telecommunications company called Unefon.

* Unefon owed some US$325 million to Canadian-based communications equipment supplier Nortel. Nortel also quotes its shares in the U.S. stock market.

* Unefon claims to be in dire straits and cannot pay Nortel.

* Nortel finally agrees to accept US$107 million to liquidate the debt.

* Unefon claims it cannot pay the US$107 million.

* TV Azteca President Ricardo Salinas and Unefon president Moises Saba form a U.S.-based corporation called Codisco.

* Codisco pays Nortel US$107 million.

* About three months later, Unefon signs a deal with Telmex subsidiary Telcel worth about US$270 million. Telmex is also quoted on the U.S. stock market.

* Unefon pays Codisco US$325 million for services rendered.

* Salinas and Saba make a cool US$109 million each on the deal.

No criminal charges have yet been filed, and the Mexican financial authority the Comision Nacional Bancaria y de Valores (CNBV) is also investigating the case.

The SEC alleges Salinas and Saba defrauded Unefon of some US$218 million. Many in Mexico have asked why that is the SEC's business. The SEC says it is their business because TV Azteca is a 45-percent shareholder in Unefon and TV Azteca is quoted on the U.S. stock market.

The commission says TV Azteca's other shareholders were damaged by the deal, and it has informed Salinas he must pay damages to TV Azteca and a fine to the SEC. If he does not comply he will be banned from executive office in any corporation that wishes to sell its shares in the United States.

Needless to say, Salinas is vigorously defending himself. He says he had no insider knowledge of the upcoming Unefon deal with Telcel.

Der Hurley is a certified fraud examiner with the forensic auditors, Sullivan Miranda, S.C.