The sky isn't falling fear of SOX is waning.

Just a few years ago the sky was falling. New York State Attorney General Eliot Spitzer wanted to slap the Sarbanes-Oxley Act (SOX), the federal corporate governance law, onto charities. Other lawmakers promised to clean up the nonprofit sector through increased regulation. The projected cost and bureaucracy of it all seemed to scare most nonprofits, and the sector as a whole, into some action on their own.

These days most nonprofits and accountants seem to be going about implementing elements of SOX as if it was part of routine business procedure to improve operations rather than the onerous hand of government regulation as it might have been viewed. And even Spitzer has softened his stance.

Federal officials have promised charitable reform this year while some states have enacted stiffer regulations on the nonprofit sector. Almost a dozen states have introduced or passed legislation within the past two years that applies parts of SOX to the nonprofit sector. California was the first state to enact comprehensive charitable reform, with the California Nonprofit Integrity Act in 2004.

"Standard best practices derived from Sarbanes-Oxley are becoming the baseline behaviors for good corporate governance," according to Cynthia Rowland, chair of the nonprofit corporations committee of the business law section of the American Bar Association. "We first started seeing interest" in Sarbanes-Oxley shortly after it became law," Rowland said, usually with large organizations whose members also sit on boards of public companies.

SOX provisions were progressive two or three years ago, and are becoming the standard practice for nonprofits, according to Sheffield Hale, chief counsel for the American Cancer Society (ACS). "They're easy to comply with and have real value to the nonprofits."

No-frills SOX

There are myriad items that SOX requires of for-profit companies. But there also are some aspects of it that can apply to nonprofits that don't necessarily require a huge investment but can bring valuable return.

A code of ethics or audit committee is not expensive because nonprofits can find examples of them at public companies, Hale said. "You can adopt them to nonprofits rather easily ... it's not as if you have to go hire a blue chip law firm to do it."

The few provisions of SOX that do apply to nonprofits have become adopted as best practices by many nonprofits, including ACS, Hale said. "It's easy, cheap. It's not just window dressing. It's substantive protection; that's an improvement to your governance process without much cost," he said.

"A lot of people are going ahead and adopting California's recommendations," Hale said. "A lot of requirements in that act actually are quite reasonable."

California is such a big market for charity fundraising from the public that it applies to national nonprofits as well, becoming very relevant across the country, Rowland said.

One aspect of SOX that's most frequently found is an audit committee and many nonprofits already had one before California's law was adopted, said Richard Larkin, a partner in the nonprofit practice of BDO Seidman in Bethesda, Md. "Sarbanes-Oxley made people more aware of the importance and significance of audit committees," Larkin said, and predictably, "people started to ask these organizations, 'Do you have, fill in the blank,' whether it's an audit committee or code of ethics. If a funder asks a question, you know what the answer will be."

Larkin, who said that he gets numerous requests from organizations for advice, said he tries to work SOX implementation into his talks for two reasons: one, it's the right thing to do, and two, people will be asking for it, and a wrong answer could be embarrassing and costly for a nonprofit.

"Where you see compliance in my end of the nonprofit world, greater than what is minimally required, is in organizations whose members' companies have been impacted," said Andrew Lang, president of LangCPA Consulting, a Potomac, Md., firm specializing in aligning financial and organization strategy for nonprofits. "But even there there's a reluctance to go quite as far as adopting the entire Sarbanes-Oxley Act."

A code of ethics and conflict of interest policy are two items that nonprofits have employed, beyond the basic SOX requirements, Lang said. Those kinds of documents are important, positive additions, and they don't require much. "Essentially, it costs nothing. There's no risk, and there's all reward."

Lang suggested that organizations with more than $1 million in revenue and expenses should have an audit. "It's very hard for an organization with $1 million to say it can't afford an audit," he said.

SOX regulations and nonprofits

Although Sarbanes-Oxley primarily targeted for-profit companies, two provisions of the 2002 legislation technically apply to nonprofits: a whistleblower policy and a provision on document destruction. "The horrible fact of the matter is most of them (nonprofits) don't, and people are very, very much behind," said Lang.

Lang, whose expertise is in associations, said that in his conversations with nonprofits and accountants, in general, many are well aware that the two documents are required. "Nonprofits don't take the issue very seriously yet, in general."

A whistleblower protection policy had been part of employee guidelines at Catholic Charities USA long before Sarbanes-Oxley came into existence, said Candy Hill, senior vice president for social policy. But when SOX was passed, the nonprofit consulted with its auditors and general counsel to voluntarily comply with the act to the extent possible for a nonprofit, she said.

"As a national organization, we feel it's our role to set high standards and communicate that to our membership," Hill said, adding that Catholic Charities members are independent of the $8.5 million national corporation.

Catholic Charities also is a part of the Better Business Bureau Wise Giving Alliance, which sets standards for charity accountability and many of its principles are best practices under Sarbanes-Oxley, Hill said.

The YMCA of San Diego instituted its own whistleblower policy, as well as an audit committee, according to CFO Paul Sullivan. "The only thing we're cognizant of that we weren't before is that you can't have more than half of the audit committee on the finance committee," he said, adding that the finance committee can become a "catch-all" in a small nonprofit. "I can see where that might be a problem of independence ... and how it can be problematic for a small organization."

Large nonprofits have a lot of the best practices of corporate governance, but many mid-sized and smaller nonprofits would not have implemented things like an audit committee separate from a finance committee, according to Steve Hermes, director of assurance services at the accounting firm of Mayer Hoffman McCann in San Diego, Calif. "It's not that they don't want to or don't see the benefit; it's a question of prioritization."

Most large states already had an audit requirement and California was the only big state that did not, Larkin said. "Two million dollars is not going to catch too many organizations that weren't having them already for other reasons," he said. The California act has had "much less an effect than a lot of people worried it might. The biggest is the audit committee, which as far as I'm concerned, everybody should've done anyway."

A lot of nonprofits, when the California legislation was enacted, had a finance committee but not a formal audit committee, said Cindy Bertrand, senior audit manager of the assurance services group at Mayer Hoffman McCann. "We've seen that, but it was just a spin-off of the finance committee and making sure everything was transparent. That was really the theme. Our donors should see exactly what we're about, lay everything out on the table because this is public money."

Bertrand, who also serves on the board of a local affiliate of the Susan G. Komen Breast Cancer Foundation, said many of her board members also served on corporate boards and their initial wont was to fully comply with Sarbanes-Oxley. "We can't comply 100 percent but we can cherry pick the areas of SOX that are good governance."

Easter Seals of Massachusetts implemented an audit committee less than two years ago, according to Adam Shuster, vice president of finance and administration. "We didn't do it necessarily in response to SOX. We just looked at best practices, what would make sense for our organization," he said. "It was something we felt appropriate to do, regardless of legislation."

Their finance committee used to serve as the "de facto audit committee," Shuster said, but the new audit committee has been "very helpful and effective.

"It gives us some additional folks to look at financial statements.... It's given the board a much higher comfort level ... they read about SOX, ask questions. Having an audit committee lets them sleep better."

Massachusetts has a bill pending that would enact some requirements on nonprofits. "Most of that will affect smaller organizations more heavily, other than an audit committee."

Jack Finning, a partner with Alexander Aronson & Finning & Co. in Westborough, Mass., and president-elect of the Massachusetts Society of CPAs (MSCPA), said SOX provisions would have a nominal impact for nonprofits that already have internal controls in place. For others, such as small nonprofits, it might cost an extra couple thousand dollars a year in audit fees. "For those not in good shape," he said, "the costs could be significant."

Some larger nonprofits, he said, have decided they will try to comply to the letter of the law of SOX, with auditor rotation and complete independence.

In a letter to the Massachusetts Attorney General's Office, the MSCPA recommended raising the threshold for requiring an organization to submit audited financials from $500,000 to $1 million, questioning whether the cost of an audit--3 to 5 percent of revenue--was justified for a nonprofit with a half-million dollars in revenues.

Sometimes it's the perception of having control rather than actually having control that can be just as effective, Hermes said. "A little extra time asking some questions, can create an environment of good governance, monitoring without spending a lot of dollars," he said. Most nonprofits say an audit is a cost they would do without because they'd rather spend the money on programs, but by having audited statements, "it gives you credibility to the public," he said, and potentially more contributions.

Restoring faith

The International Swimming Hall of Fame (ISHOF) in Fort Lauderdale, Fla., is in the process of rewriting its entire bylaws. "We're just trying to turn around a situation that had us going toward a watery grave," said Bruce Wigo, president and CEO.

Many of the items in the Sarbanes-Oxley Act "don't apply to our type of business, but certainly some of the important provisions," Wigo said.

"Transparency is a key," he said, adding that an audit committee, audit rotation, and accounting background are important keys in selecting a board.

The hall of fame has fallen on hard times, as it used to have an annual budget and revenues of $1.5 million that has dwindled to half a million dollars. "A lot of that was because there was no transparency. There were board members that sat on there for many years," Wigo said, and these are issues that go across the nonprofit and for-profit sector.

If an officer of an organization, such as a CEO/president says the organization has never been in better financial condition, and people don't know any better, they believe it, he said. There was no audit committee and no board members with an accounting background. "A lot of nonprofits run into that similar situation," Wigo said, when the life cycle of an organization runs into not getting people on a board because of their qualifications but because they're friends with someone. "That's a danger, especially for nonprofits," he said.

"We got a chance to see what Sarbanes-Oxley was aimed at," Wigo said. "We've created committees, followed pretty much what Sarbanes-Oxley was doing with that.

"The real issue was confidence in the financial component of an institution. It's very comparable to shareholders. They're not going to buy stock, and stakeholders are not going to contribute" if confidence in the organization does not exist.

Costs and Section 404

The most daunting aspect of the Sarbanes-Oxley Act--whether a for-profit corporation or a nonprofit organization--is Section 404, which requires an annual report on internal controls that the auditor must attest to.

"It's expensive for for-profits to have auditors look at the quality of internal controls, but they have to. Since they don't have to, nonprofits consider it cost-prohibitive," Lang said.

Section 404 is "an additional expense that most nonprofits will be very hesitant to do until required," said Hale, of the American Cancer Society. "Small, publicly held companies are screaming about it. It's dramatic. There's a lot of debate on the cost-benefit ratio of for-profit companies."

Hermes believes California's Nonprofit Integrity Act likely would not have been passed if it required an internal controls component. "That would're been an extremely costly component if it had to try to include that.

"Legislation rightly focused on best practices in terms of the governance component," he said, without getting into the internal controls area. "And that's where we're seeing most of our clients on the corporate side spending huge amounts of time and money."

Larkin, of BDO Seidman, agrees when most nonprofits don't follow up with the internal controls audit. "Not because it wouldn't be nice, but because it would be unaffordable. Even if you could, it's probably not the wisest use of limited resources," he said. Nonprofits have higher priorities, whether it's feeding the hungry or fighting for a cause. "Program comes first."

Kevin Hite, nonprofit industry director for Deltek Systems, an application software company that counts hundreds of nonprofits as its clients, said he's seeing more and more nonprofits adopting parts of Sarbanes-Oxley on their own as best practices. "Even if legislation doesn't pass, we're seeing a gold standard in best practices emerging."

While Section 404 of Sarbanes-Oxley, attesting to internal controls, might be expensive to implement, Hite said it doesn't have to come all at once. Instead, he suggested it can be started in stages to satisfy those requirements, implementing software with segregation of duties and audit trail capabilities.

Shuster said that while Easter Seals Massachusetts is a $7 million organization, there are fewer than three full-time employees to handle accounting and finance issues. "We don't have the ability to do all that testing and documentation. That would be an extraordinary cost for us."

He also has mixed feelings on rotating auditors or auditor partners, something Sarbanes-Oxley requires. "It's nice to have a fresh look," he said, but it would take a lot of effort and expense to get someone up to speed in the first year. "I appreciate the intent of various SOX regulations," he said, but questioned if there's true value in the routine rotation of auditors. "Each organization must weigh the costs and benefits of it." In some organizations, the costs will outweigh benefits, he said, while in others the opposite will be true.

Audit fees in the for-profit sector have gone up 50 to 100 percent since SOX was implemented, Larkin said. "It's so time consuming, there's no way to do it without spending a lot time, which means a lot of money."

Rowland said accountants are swamped with work since California enacted its law, and with increasing demand, the price of audits has risen. Two years ago, when regulation started to be discussed, a simple organization's audit might be $5,000 or $10,000. That organization now is getting a quote of $10,000, with some as high as $25,000, Rowland said.

"The problem we're facing is overall demand has never been higher ... because of how much is being done," Hermes said. Nonprofits will see audit fees continue to rise, not as quickly as for-profit, as there is greater demand. Supply has not grown as quickly, putting pressure on fees. "If I'm a nonprofit, average to mid-size, it's probably not a problem. If I'm very small, it's a challenge to find a cost-effective response to the requirement."

Future of nonprofits and SOX

For nonprofits, it's such a diverse industry that the huge institutions that should've been doing good corporate governance all along will survive, Rowland said. It's the local community group, she said, where it will be felt. Due to the new regulatory burdens, it just doesn't make sense starting a new charity, she said, unless you know you've got a budget of $1 million or more, because compliance costs are so high.

When Sarbanes-Oxley is layered on top of state laws and regulations, Rowland said, requirements might become difficult to meet for small organizations that rely on volunteers.

Even if federal charitable reform becomes reality, Larkin expects some states to continue to dip their toes into regulatory issues for the nonprofit sector, particularly New York.

RELATED ARTICLE: Nonprofits and Sarbanes-Oxley.

There are 10 general principles of corporate governance emerging from the Sarbanes-Oxley reforms, which may be worthy of consideration for the governance of nonprofit organizations, according to the American Bar Association:

* Principle 1 Role of Board: The organization's governing board should oversee the operations of the organization in such manner as will assure effective and ethical management.

* Principle 2 Importance of Independent Directors: The independent and non-management board members are an organizational resource that should be used to assure the exercise of independent judgment in key committees and general board decision-making.

* Principle 3 Audit Committee: An organization with significant financial resources should have an audit committee composed solely of independent directors, which should assure the independence of the organization's financial auditors, review the organization's critical accounting policies and decisions and the adequacy of its internal control systems, and oversee the accuracy of its financial statements and reports.

* Principle 4 Governance and Nominating Committees: An organization should have one or more committees, composed solely of independent directors, that focus on core governance and board composition issues, including: the governing documents of the organization and the board; the criteria, evaluation, and nomination of directors; the appropriateness of board size, leadership, composition, and committee structure; and codes of ethical conduct.

* Principle 5 Compensation Committee: An organization should have a committee composed solely of independent directors that determines the compensation of the chief executive officer and determines or reviews the compensation of other executive officers, and assures that compensation decisions are tied to the executives" actual performance in meeting predetermined goals and objectives.

* Principle 6 Disclosure and Integrity of Institutional Information: Disclosures made by an organization regarding its assets, activities, liabilities, and results of operations should be accurate and complete, and include all material information. Financial and other information should fairly reflect the condition of the organization, and be presented in a manner that promotes rather than obscures understanding. CEOs and CFOs should be able to certify the accuracy of financial and other disclosures, and the adequacy of their organizations' internal controls.

* Principle 7 Ethics and Business Conduct Codes: An organization should adopt and implement ethics and business conduct codes applicable to directors, senior management, agents, and employees that reflect a commitment to operating in the best interests of the organization and in compliance with applicable law, ethical business standards, and the organization's governing documents.

* Principle 8 Executive and Director Compensation: Executives (and directors if appropriate) should be compensated fairly and in a manner that reflects their contribution to the organization. Such compensation should not include loans, but may include incentives that correspond to success or failure in meeting performance goals.

* Principle 9 Monitoring Compliance and Investigating Complaints: An organization should have procedures for receiving, investigating, and taking appropriate action regarding fraud or noncompliance with law or organization policy, and should protect "whistleblowers" against retaliation.

* Principle 10 Document Destruction and Retention: An organization should have document retention policies that comply with applicable laws and be implemented in a manner that does not result in the destruction of documents that may be relevant to an actual or anticipated legal proceeding or governmental investigation.

Source: "Guide to Nonprofit Corporate Governance in the Wake of Sarbanes-Oxley, " section of Business Law and Section of Health Law by the ABA Coordinating Committee on Nonprofit Governance

State             Legislation

Arkansas          Disclosure requirements for organizations soliciting
                  funds.

California        Organizations with $2 million or more in revenue
                  Audit performed annually by independent CPA and made
                  available to public and attorney general. Audit
                  committee must be formed from members of board.
                  Executive compensation requires board approval.
                  Disclose written contracts with fundraisers,
                  audited financial statements Form 990.

                  All nonprofits
                  Registration with Registry of Charitable Trust must
                  be done within 30 days. Notice of solicitation
                  campaign must be filed at least 10 days before
                  commencement. Contracts with commercial fundraisers
                  must be signed by an officer and contain specific
                  language; fundraisers must be registered.

                  Misrepresentation by charity of purpose, nature,
                  beneficiary of solicitation prohibited. Control
                  required over fundraising and approval of contracts,
                  assuring fundraising is conducted without coercion.

Colorado          Additional information required on the charitable
                  organization registration form. Expenses must reflect
                  amounts paid to professional fundraising consultants,
                  solicitors, etc. Non-profits exempt from prohibition
                  against unsolicited foxes, if have received written
                  permission from individual.

Connecticut       Annual registration requirement, with $25 fee,
                  rather than just once and prepare annual financial
                  report. Audited financial statement requirement for
                  organizations with $200,000 or more in revenue.

Hawaii            Attorney general authority may remove directors/
                  officer who breach duties. Notice required prior to
                  mergers/sale of assets.

Iowa              Replacement of current nonprofit corporation
                  provisions including director/officer standards,
                  conflict of interest policy, and prohibition of
                  loans/guarantees to directors and officers.

Indiana           Disclosure of information by professional solicitors.
                  Attorney general authority to seek remedies against
                  violating non-profits and trusts.

Kansas            Soliciting organizations must submit a copy of
                  federal income tax return with the secretary of
                  state. Organizations with $500,000 or more in
                  revenue must file audited financial statement,
                  raising threshold from $100,000.

Maine             Audit, Form 990 requirement during registration
                  renewal

Massachusetts     Audit, additional filing requirement for
                  organizations with $500,000 or more in revenue.
                  Financial review requirement for organizations
                  with $100,000 to $500,000 in revenue.

Mississippi *     Increases threshold for nonprofits required to
                  submit financial statements to the secretary of
                  state from $100,000 to $250,000. Another bill would
                  allow the governor or any member of the legislature
                  to request an audit of a nonprofit receiving more
                  than $1,000 in state funds.

New Hampshire     Financials filing requirement with attorney general
                  for organizations with $500,000 or more in revenues.
                  Community needs assessment reporting requirement
                  changed to five from three years.

New Jersey        Raises to $100,000 to $200,000 the threshold in gross
                  contributions requiring charitable organizations to
                  file an audit. Requires registration not only of
                  independent paid fundraisers and fundraising counsel,
                  but also of any subcontractors. Modified disclosure
                  language to be included on all solicitations.
                  Requires filing written contracts for independent
                  fundraisers and fundraising counsel. Exempts from
                  filing, volunteer organizations whose previous year's
                  contributions were less than $100,000.

New York *        Encourages, but does not require, audit and executive
                  committees. Encourages, but does not require, very
                  large boards (those with 25 or more members) to
                  establish an executive committee, and large
                  nonprofits (those with $2 million or more in support
                  and revenue) establish an audit committee. Maintain
                  internal system of financial controls.

Note: Asterisks indicate legislation only has been proposed.

Sources: National Council of Nonprofit Associations

"Under Scrutiny, The U.S. Nonprofit Sector Embraces Corporate-Style
Oversight" Standard & Poor's, October, 2005