Sarbanes-Oxley Costs Exceed Benefits

coondoggie writes "Two years of compliance with the Sarbanes-Oxley Act (SOX) have shored up corporate accounting practices - but with lopsided costs compared to benefits gained. Bill Gradison, acting chairman of the Public Company Accounting Oversight Board (PCAOB), said that guidance the SEC issued last year and PCAOB's latest auditing standard may not be enough to clarify the rules that govern the reporting and auditing of internal controls. 'Based on the information we already have, it would seem that some further changes may be in order,' Gradison said."

Comments

Misleading summary

[Raul654]

Here's the title of the article: "Execs tell regulators Sarbanes-Oxley costs exceed benefits". Here's the slashdot title: "Sarbanes-Oxley Costs Exceed Benefits". Notice the difference?
 
Sarbanes-Oxley is a *very good thing* - it exists to prevent another Enron. It makes CEOs criminally liable for when their companies cook the books. Amazingly, for some inexplicable reason, they don't seem to like it. Everyone reading this should go over to Netflix and add Enron: The Smartest Guys in the Room to their queues. It shows exactly how Enron was able to pull off the accounting shell-game that kept them afloat for years.

Re:Misleading summary

[Russ Nelson]

Nobody is saying that SarbOx has no benefits. Everybody is saying that SarbOx is too expensive for the benefits it returns.

Re:Misleading summary

[Bill Walker]

I think you're confusing the goal of the act with its actual ramifications. Sarbanes-Oxley amounts to a regressive cost of doing business. Small firms pay a disproportionately larger share of their revenues to comply: they have to hire a lawyer or auditing firm when they could have done the paperwork themselves in the past. Meanwhile, larger corporations merely pay more to their existing compliance teams.

Meanwhile, financial companies, especially hedge funds, are increasingly choosing to set up shop in London rather than New York/Connecticut to escape the burdens of Sarbanes-Oxley and SEC registration. Like them or not, these entities contribute a huge amount of money to local coffers: investors flock from all over the world to place capital in hedge funds, and they leave generally 2% of the investment and 20% of the profit annually with the fund managers.

No-one wants more catastrophes like Enron, but that doesn't mean we should throw the baby out with the bathwater.

Re:Misleading summary

[Bob_Robertson]

Exactly. This article from November says exactly the same thing:

http://blog.mises.org/archives/004345.asp

"In contrast, the CEO of Georgia Pacific explained that his company sold out to private Koch Industries in order to avoid mounting Sarbox costs."

and

"No doubt, a company that had poor controls may have improved them in order to comply with Sarbox. This does not mean that U.S. businesses in aggregate benefited from Sarbox. A law mandating a 45% increase in marketing spending might help some companies too, but it would cripple most others. Even companies with superior internal controls were forced by this perverse law to spend more money on internal controls."

Re:Misleading summary

[Anonymous Coward]

Everybody is saying that SarbOx is too expensive for the benefits it returns.

No they aren't. It's not everybody who is saying that, just the people who look at it and think, "Fuck! How they hell am I supposed to fund that?"

The rest of us went from thinking "Jesus Fucking-a-Llama Christ! That cock sucking texan just evaporated 10 billion dollars and he's living in a fucking mansion and my pension just disappeared." to "Don't like the costs? Too bad. Maybe you should have called bullshit on your peers when they were busy hiding the fact that they really weren't capable of running a business."

Re:Misleading summary

[Firehed]

Wouldn't it be even better to protect society from 'ethics criminals'? Oil companies are refusing to do anything to lower pump prices because it's not in the best interest of the shareholders, despite it being in the best interest of society as a whole. Captialism is bad for society unless society is a subset of shareholders. Yes, protecting investors from corporate dickheads is a good thing, but protecting everybody from monopolized money-loving dickheads must be a better thing.

I'm not disagreeing, I just think that our priorities are a bit out of whack.

Re:Misleading summary

[Quantum Fizz]

Meanwhile, financial companies, especially hedge funds, are increasingly choosing to set up shop in London rather than New York/Connecticut to escape the burdens of Sarbanes-Oxley and SEC registration.

Using your same logic, here in the US we should also repeal child labor laws, environmental regulation, and occupational safety laws, merely because many US companies will open shop in in other countries where there are looser pollution regulation, safety laws, etc. Think of how much business the US economy is missing out on due to these regulations pushed by 'liberals'.

The scary thing is that a typical pro-big-business Republican would agree wholeheartedly with my paragraph, without sensing its sarcasm.

Re:Misleading summary

[bnenning]

Oil companies are refusing to do anything to lower pump prices because it's not in the best interest of the shareholders, despite it being in the best interest of society as a whole.

No, it isn't. High prices encourage conservation and investigation of alternatives, which is exactly what's needed when demand exceeds supply.

Re:Misleading summary

[jcr]

Sarbanes-Oxley is a *very good thing* - it exists to prevent another Enron

No, it's killing a butterfly with a cannon. Because one company was run by a bunch of crooks, every other public company has to vastly increase their costs, which is money that isn't spent of improving their products, hiring more workers, or cutting prices to their customers.

Let me point out that it was the market that brought Enron down, not the government.

-jcr

Re:Misleading summary

[Maxo-Texas]

SOX has reduced my productivity by 75%.
I spend the rest of the time (15 to 20 hours per project) filling out several forms that I didn't used to have to fill out, doing self-audits to confirm I filled out the forms, waiting for approval of my forms before I can go to the next step, etc.

Meanwhile- the execs in my company can write a $20,000 check without even a counter-signature from another exec and much larger checks with a counter-sig from *one* other exec with NO required paperwork of any kind and they get paid literally millions of dollars while our stock has declined constantly in price for years.

Why the heck sox means the "Massive Paperwork for Programmers" is beyond me.

And then when we have a high priority project that a big executive wants fast-- we toss all the paper work out the window and backfill it afterwards (even putting links to empty documents that will be filled in later).

Yea right- sox is a very good thing-- NOT. We already had laws against fraud. All we have to do is start ENFORCING them.

Re:Misleading summary

[thejeffer]

You're forgetting an important fact. A LARGE percentage of America is knowingly or unknowingly a shareholder in oil companies. You know that retirement plan you have? Your 401k? Those mutual funds you bought? Guess what they include as part of your portfolio? That's right. Shares in those horrible oil companies. The American public loses sight of the fact that while high gas prices certainly hurt your pocketbook right now, there's a silver lining... in the long run, it's actually building up your retirement fund.

Now that's not to say I'm happy with the oil companies. Along with a responsibility to please your shareholders, an ethical company also has a responsibility to act for the benefit of society when they can. In the oil companies' cases, this would mean pumping some of those huge profits into R&D and building new refineries so that we have the capacity to keep artificial shortages from happening.

Just saying though... with the amount of people who hold shares in these companies either directly or through mutual funds, the actions that are best for shareholders might actually be those that are best for society in the long run.

Re:Misleading summary

[EweLambGeo]

I strongly disagree with this objection. Sarbox, IMHO, is the most poorly conceived and implemented piece of government regulation to come out of Washington since the Carter adminstration attempted to allocate gasoline deliveries at the retail level. In case you were not driving then, gas stations ran out of gas all over the US. It was awful, especially if you needed to get somewhere. What the SEC hath now wrought is a set of undefined requirements which it has told the entire American corporate world to go implement or be ... severly punished.

While slashdotters may derive a justified modicum of rightously deserved glee in this state of affairs - who here hasn't been given like orders - the economic waste on the national scale is so hideous that it needs airing. Never before has so much money been wasted on useless butt-plate.

The concept here is that corporate processes need to be audited independently to prevent fraud and malfeasance. Wonderful idea. What the SEC people had no clue about, however, was just how many processes there are churning away every day in a normal company. There are thousands! If you want to monitor the pain Sarbox is inflicting, subscribe to the alerts from CFO.com. For example, one company just found out it would have to pay its auditors - that's right, the people who failed to catch Enron's malfeaseance - $50,000 a year just to audit its employees vacations. That's not so much alone, but when you multiply it by everything going on in a company, the costs are absolutely humongous. And all of this money is going to the people who not only failed to prevent Enron but told them how to do it. Something is seriously wrong here.

Proportionately, the costs for smaller businesses are much higher (typically 20x). This has an anti-technology bias that hurts all of us in technology and eventually the whole economy. Because our start-ups are small and Sarbox denies us capital, we will not be able to hire and develop. This is bad Kool-Aid.

The supporters of Sarbox are: a) Big Labor - they are more successful unionizing big/old companies, fail miserably with high-tech startups, hate us, and actively seek to ruin us, b) Auditors - they make the money from this regulation, c) Regulators - from their perspective, regulation is always good and Sarbox means hiring many more of them.

The losers are everyone else, especially us in the tecnhology sector. I'm developing technology that could make corporate treasuries more efficient by increasing their control of liquid assets. I cannot sell it because of Sarbox and all its distractions. Ironically, corporate treasuries are so involved in dealing with the worthless regulatory minutia of Sarbox that they cannot invest the time to evaluate systems that would actually improve their control of corporate liquid assets.

I wish I could conclude this rant by recommending what we should do, but I am not as politically astute as our foes. All I can say is let's hope for the best and maybe someone out there in the political world will get a clue.

Re:Misleading summary

[Raul654]

So what you are saying basically amount to - giving an honest accounting of a company is expensive? Ok, so be it. Companies that find a way to do this cheaply and effeciently will prosper (and have their standards adopted by others), and ones that don't will tank. And in the future, investors won't again have to worry about CEOs lying on balance sheets in order to cheat the market (at least not using the same bag of tricks that worked for Enron/Worldcom/Tyco/et al).

Re:Misleading summary

[Brandybuck]

it exists to prevent another Enron

The executives of Enron broke the law. Let me repeat, in case you didn't hear: the executives of Enron broke the law. As a law abiding citizen, who naturally obeys the law just because it is there, that's undoubtedly an alien concept. It certainly is to me. So I will say it again. The executives of Enron broke the law.

Criminals do not obey the law. Sarbanes-Oxley won't prevent another Enron. It's just another law that criminals will ignore but which will punish the law-abiders.

Re:Misleading summary

[aclarke]

The idea of corporate accountability is a good thing. The implementation of SOX in many companies is an utter nightmare.

Large companies have the economy of scale to spend money and do a proper SOX implementation. For smaller companies, this is simply cost prohibitive. One company I worked at briefly left me sitting around for probably 30-40% of my day because there was no work "authorized" for me to do. I would go almost every day to my boss and ask for something to do and he would tell me straight up that there was nothing I was allowed to do. I saw opportunities all over the company and would specifically ask him if I could do x or y and would be told no. He was scared "someone" would catch me doing unauthorized work, since we had already had one poor SOX audit.

I went to a director in the marketing division and asked him if I could help him out in some specific ways until he hired for some of his positions and got a similar response. Because I was in IT, I wasn't ALLOWED to do any work for marketing. Because of SOX.

Everything we did had a paper trail, which again in theory is a good thing. Except, because of SOX, everything has TWO "paper" trails: one on the intranet, and one in filing cabinets. The old, electronically based system was not 100% SOX compliant so they had to do a paper one for SOX until <insert unreasonably expensive SOX system /> was installed.

Sure, a lot of these problems are due to poor, inept management. However, it hamstrung the 80% of us who WANTED to do a great job (including my boss) and just couldn't. This is the spectre of SOX, and why it's hurting many medium-sized publicly traded businesses.

I'm glad to be working for privately held "me" again :-)

Re:Misleading summary

[synx]

I think the parent was fairly clear - you are not getting what you think you're paying for. You are _not_ getting a honest accounting of a business. Only the appearance of one. Remember, that the external auditing companies that are being paid for this stuff are the exact same ones that were complicit in the Enron thing.

Some of the SOX stuff is reasonable - although most large companies are already doing that. But some of the other parts are more or less insane. Like the infamous section 404 - everytime I push a particular piece of software I need to audit that. I need to do extra paperwork that does not really improve anything, since I'm not doing anything new but filing out some bit of electronic retardedness.

The section 404 stuff is ridiculous. Why do we need individual audits of software pushes? I push a 1 line change, I need to fill out a SOX thing.

In the end, all the big problems happen at the exec/policy/corp level. And those people are always part of the "good-old-boys club" (Not girls, BOYS. Girls not allowed. You know, period stuff and all of that.). If you are part of the club, you don't get punished, unless you severely embarrass everyone else as Lay and Enron did.

We need better corporate governance. This legislation was ill concieved and simpleminded. Just the way the crafters wanted it - because SOX does not prevent Enron 2. Just the way it was designed. Looks like it should be effective though.

Re:Misleading summary

[Ohreally_factor]

Well, you didn't come out and say it, so I'm not sure if it's what you have in mind, but if you mean that the very laws that give "life" to corporations need to be re-examined, then yes, you've got an excellent point. I'd go even further, and say that the very assumptions that out culture and civilization are based on need to be re-evaluated.

But who is to do such a re-evaluation? The politicians? Heh. No, it's got to be you and me. And is there any hope in hell of pushing through such changes of underlying assumptions, given that the ones who don't want the assumptions changed have guns, money, and inertia on their side? No. So, the best either you or I can do is to make changes in our own little lives, and maybe help those we come into contact with change their own assumptions, if they want it.

Ever thought of getting off the grid? Or if that's impossible, moving as much of one's life off the grid, becoming less dependent on the grid, leaving a smaller footprint?

Meanwhile, legislation like S-O might help people from getting ripped off.

Re:Misleading summary

[Anonymous Coward]

No doubt, a company that had poor controls may have improved them in order to comply with Sarbox. This does not mean that U.S. businesses in aggregate benefited from Sarbox. A law mandating a 45% increase in marketing spending might help some companies too, but it would cripple most others. Even companies with superior internal controls were forced by this perverse law to spend more money on internal controls.

Ageed. My company kept track of how much time was being spent on SarbOx compliance. From the start of 2004 through the first two months of 2005, we had recorded well over 100,000 hours dedicated solely towards performing SarbOx related tasks... What a waste.

Re:Misleading summary

[HTTP Error 403 403.9]

Stop saying 'companies' like every mom and pop grocery has to do this. SOX only applies to publicly-held companies. And publicly-held companies had to be audited by an external auditor, even before SOX.

That's not fair, you are using facts and reasonable logic to prove your point.

This is Slashdot, please return to using hyperbole, straw man arguments and ad hominem attacks.

Re:Misleading summary

[Dachannien]

The thing is, the link between cost and (public) benefit for child labor laws, environmental regulations, and occupational safety laws is plainly visible, and in most cases the cost of compliance is proportional to the size of the business. Not so for Sarbanes-Oxley, where the cost of compliance is, in general, greatest as a proportion of revenues for smaller businesses than for large ones, and where the public benefit is practically undetectable for small businesses as opposed to large ones. It's getting to the point where the motivation to small publicly-traded corporations is to either incorporate in a foreign country or to go private just to save costs.

I believe that Sarbanes-Oxley addresses a problem that needs to be addressed, but does so without consideration for the needs of the companies expected to stay in compliance with it. Low-income citizens are given disproportionately large tax breaks to account for their disproportionately greater needs, so why shouldn't something similar apply to small businesses when it comes to Sarbanes-Oxley?

Re:Misleading summary

[Afrosheen]

I'm not buying the nonsensical argument that the media and big oil keep throwing the public about 'demand exceeding supply'. There are no supply and demand economics at work here. If that were the case, then one would have to assume that over the last 5 years, US consumption has tripled, because prices have tripled. Generally prices go up if demand can't be met, and demand not being met is generally because supply is low, or the supplier is restricting output to drive prices up.

  The big oil companies have more excuses than a hound dog has fleas. Last year it was 'oh no teh hurricanes!?', this year it's 'oh snap what about Iran?!' and 'hey we have to switch over to a summer blend, it's teh expensiveness!'. It's all bullshit. If the oil companies were really having such a difficult time making money (i.e. their supply is low and costs are up therefore we're paying extra), why would Chevron and Exxon post their highest earnings IN HISTORY over the last few quarters? Exxon's profit equalled Bill Gates' total value a few quarters ago. 41 billion dollars. If the market is controlling prices, then big oil wouldn't be raking in ungodly earnings, they'd have a steady cash influx just like every other year. The truth is that with the GOP at the reigns, and two oilmen running the White House, it's open season on consumers when it comes to gas prices.

  Sorry to get political at the end there, but it's not hard to make the connection between the Bush family, Saudi nationals, a VP (Cheney) that sits on the board at Halliburton and our current situation.

Re:Misleading summary

[benna]

Of course SarbOx is not profitable for businesses. If it were, it would already have been implemented before congress passed the law. The point is that the burdensome new procedures have positive externalities which outweigh the increased costs.

Re:Misleading summary

[JKConsult]

As has already been pointed out in another response to your post, Enron didn't create their mess all by themselves. Arthur Andersen, as both their auditor and their consultant, did as much, if not more, that led to Enron's downfall. But even if it had been Enron all by themselves (meaning that they would have had to present false books to Andersen, and cover up the existence of the shell companies [called 'Raptors' internally by Enron] when actual physical checks were made, which is much harder to do than you think), the severity of the resulting disaster made the people, the government, and the FASB think about the overall climate of business. They found that it was lacking, and they made a move to fix it.

While I think that the argument that Sarbanes-Oxley is deficient in solving the issue is false, I will listen to arguments to the contrary. Any attempt to claim that a public company should not be doing everything in their power to ensure that their books are correct and that they are following GAAP (along with other compliance) is ludicrous. It doesn't benefit the public, and in the long term, it rarely benefits the shareholders. Is any company going to be perfect? Of course not. But for GE to complain that spending a tenth of a percent of their pre-tax income on one of the most important fundamental shifts in regulation is not merely laughable, it would give me long pause if I were a major shareholder or potentially one.

They're certainly allowed to bitch about the cost (and they always will, no matter what it is), but when it's as generally as low as it is, especially for corporations the size of GE, it makes one wonder about their dedication to proper reporting. And that's not a good thing to be wondering about.

Re:Misleading summary

[NoOneInParticular]

Smallcap businesses are hurt by it. I work for a 300 people public company that develops software for businesses. Since Sox came into effect, the company spends as much money on accounting as they do on software development. The company has two choices now: grow rapidly so that the accounting overhead (4 million per quarter) becomes less significant, or go private.

The enormous amount of regulations coming with Sox are chilling, and it simply is out of proportion for the damage small and midcap companies can do. This particular company is now running break-even. It would be profitable if not for Sox.

Re:Misleading summary

[Bob_Robertson]

"This is dumb. And naive."

Naive maybe. Dumb? Do you understand what that word actually means?

"Completely free markets don't work."

Yes, they do, and more efficiently than regulated ones. If regulation solved problems, there would be no pollution, no corruption, no scandals.

If I promised that hitting yourself in the head with a hammer would feel better than not, and you hit yourself and discovered I was wrong, you would not hit yourself in the head again. Government has promised to solve problems with regulation and those problems have not been solved. Why do you continue to hit yourself in the head with government?

"Game theory suggests..."

Game theory is based upon zero-sum outcomes. Someone wins, someone loses. The more that others lose, the more one wins, so of course there are people who will dump on others for the greatest gain.

Economics is not a zero-sum game. Value is created specifically because of trade. A rock in the ground is worthless. A diamond ring is worth lots of money. At each stage in the process the new owner has traded some of their treasure for something they value even more, while the old owner has traded something they valued less than they gained in treasure. The final transfer very likely does not involve any transfer of material treasure yet each party deems that they have gained from the exchange.

Those in real life, not games, gain the greatest amount by having the freedom to trade what they wish when they wish. Both sides of the transaction gain the greatest tangable and intangible reward by satisfying their wants in the most mutually satisfactory way.

"...when the facts might be a few billion in economic damages or thousands of people with asbestos-induced cancer."

Demonstrate harm, prosecute harm. If asbestos causes cancer, prosecute those who knowingly continue its use. If someone does not know, educate them and then prosecute if they do not change their materials (because then it's knowingly acting to cause harm).

Now, remind me again how a free market doesn't work?

Re:Misleading summary

[Luscious868]

Enough with the "evil oil companies" bullshit. They don't make anywhere near the amount of money that oil producing nations themselves make when crude prices are high. Saudi Arabia will make $55 billion dollars more this year than they made last year due to the increased price of crude. 55 billion more than they made last year. That is about 27.5 billion dollars more a quarter than they made last year. Exxon-Mobile's profits this last quarter were only 3.8 billion. Not 3.8 billion more than the same quarter last year. 3.8 billion. That is a pittance compared to what Saudi Arabia and other oil producing nations (13 out of the top 15 being dictatorships) make. Oil companies do not set the price of oil. It's commodity and the market sets the price. There are supply and demand issues that are affecting the price of oil. There is a limited supply and ever increasing demand. China and India now use the same amount of oil that the USA used 10 years ago. The oil companies don't have any control over that. OPEC does. They could increase output if they wanted to. They don't want to. They market will bear these high prices, so there is no real incentive for them to do anything about it. Oil companies make an average of 9 cents a gallon on gasoline. 9 cents. I'm sure you don't believe that but the wonderful thing about our capitalist system is that these are publicly traded companies and with a little effort you can go look it up. The government, on the other hand, makes more than twice that in taxes. I don't here anyone talking about a windfall profits rebate from the government. Do you know how much more they are taking in gasoline taxes than they were a few years ago? You liberals don't bitch and moan about that. I don't hear people bitch and moan when countries like Venezuela and Bolivia nationalize their oil fields which results in reduced and inefficient production of oil which drives prices up. I hear them cheer it. I don't hear people bitch and moan when environmentalists prevent drilling in a small area of ANWR which limits our supply and drives prices up. I hear them cheer it. I don't here people bitch and moan when the government taxes ethanol imports to "protect" our farmers which drives gasoline prices up because the ethanol from corn that we can produce here costs more than the ethanol produced outside the country from sugar cane and other products in places like Brazil. I hear them cheer it. I don't here people bitch and moan when additional drilling isn't allowed to occur in the Gulf of Mexico which further limits our supply. I hear them cheer it. I don't hear people bitch and moan when drilling isn't allowed in the Great Lakes which again limits our supply. I hear them cheer it. I don't hear people bitch and moan when environmental regulations become so restrictive that oil companies are unable to open new refineries, which limits supply. I hear them cheer it. I don't hear people bitch and moan when individual states choose to dictate to the oil companies which mixtures of gasoline are allowed to be sold in the state which results in a more complex distribution network and drives prices up. I hear them cheer it. Yet you all scream bloody murder at the oil companies when all of the stupid decisions you make over the years finally come back to bite you in the ass in the form of increased oil and gasoline prices. You want to know who is responsible for the current supply crunch my friends? Look in the mirror. If we had made smarter decisions 10 years ago by allowing additional domestic drilling and allowing new gasoline refineries to open we wouldn't be in the position that we are in today. The fact of the matter is that we need today, and will continue to need for the next 10 to 20 years, ever increasing amounts of oil. Demand in China and India will only increase as well. If we do not increase supplies of oil domestically and increase refining capacity then we will continue to be bent over a barrel. By conservative estimates, we are at least 25 years away from transitioning to a primarily alternative energ

Re:Misleading summary

[Senjutsu]

Game theory is based upon zero-sum outcomes.

There goes any shred of credibility you've been clinging to. Zero-Sum games are but one branch of games studied by Game Theory.

Too bad for them.

[Spazntwich]

But laws like this wouldn't really be necessary if businesses had followed the laws in the first place, huh?

Too bad it only takes a few bad apples to ruin it for everyone.

Re:Too bad for them.

[drsquare]

You might have a point if only the small minority of companies which broke the law were punished by this legislation, however even the innocent companies are being hammered.

Sarbanes-Oxley is like shooting a machine gun into a crowd because one person there robbed a bank. But then any shit gets modded up on this site.

The Heavy Hand of Sarbanes-Oxley

[Anonymous Coward]

SOX is a very heavy burden on small businesses that are public. The real winners under SOX are the auditing firms.

Re:The Heavy Hand of Sarbanes-Oxley

[greginnj]

SOX is a very heavy burden on small businesses that are public.

Note the emphasis. Most posts are just saying 'companies'. Kudos to you for saying _public_. If you want to get the windfall of an IPO, if you want to have stock in your company traded on an American exchange, you submit to the relevant regulations. It's not like there haven't been any cases of unchecked corporate malfeasance screwing over the small investor, have there? So, the costs are passed on through stock dividends (or less directly, through share prices, which are essentially expectations of dividends), and SOX serves as a form of insurance against fraud for the small investor.

Not surprising.

[JKConsult]

First, of course companies are saying this. Sarbanes-Oxley requires them to do things that they don't want to do, namely properly assess their controls and have the CEO and CFO officially sign off on financial reporting.


But the real issue is that proper external financial reports aren't for the business (though they do help it, as long as the business pays attention to what they say.) They're for external users. And I can tell you right now that while banks who are looking to loan money, analysts who are grading performance, and investors who are looking to invest in a company's stock or bonds wouldn't mind seeing any costs cut, they don't think that the benefits are outweighed by the costs. They'll take the best information they can get, no matter what has to be done (within some modicum of reason.) And that's the point of Sarbanes-Oxley.

In 2004, GE spent about $33 million on Section 404 compliance, and costs ran about the same in 2005, Ameen said.
According to a quick perusal of GE's 2004 10-K, they had $20 billion in pre-tax income. I don't think $33 million is remotely too much to insure that that 10-K is correct.

UNIX Audit Tools

[__aahsof7392]

I have quite a bit of experience with Sarbanes-Oxley and UNIX compliance. One weak area is auditing root and shared account access. Generally the developers know the application account's password (like oracle or db2) and it's really hard to audit who did what. I created the tool Enterprise Audit Shell (EAS) which centrally logs shell access and sessions in an enterprise environment. Sessions can be snooped in real-time or played back at a later time. Each session is digitally signed and transmitted via OpenSSL. Project Site http://sourceforge.net/projects/eash Support Forum http://eas.strchr.net/

Very unpopular sentiment

[Bob_Robertson]

Government regulation always increases costs, because the regulation has costs of compliance.

Crooks don't comply, because they're crooks.

Customers, that's us, end up with higher prices for the things we buy, and higher taxes to pay for all the new auditors.

Martha Stewart goes to jail while the real criminals get away with what they've always gotten away with.

Politicians get reelected for having "done something".

To quote from the movie Spartacus, "I'll take a little republican [style of government, not party] corruption, along with republican freedom!"

Want to really put the screws to "corporate executive" crime? Then eliminate the government granted limited liability that a "corporation" represents. Allow thereby the officers of a company to be directly liable for their decisions, their accounting practices, their performance.

It's easy to follow the Big Lies handed down by the sensationalist press that don't want you looking at their own corporations and unions. S-O doesn't solve anything. It merely adds another layer of bureaucracy to the effort of getting anything accomplished.

Bob-

Re:Very unpopular sentiment

[bolerobell]

Quick note. Limited Liability afforded by corporate status doesn't protect the officers, it protects the owners (shareholders) from liability.

However, I don't necessarily think that eliminating the corporate form is bad. I think it runs counter to a true free market (because corporations by design work to restrict real information about the marketplace). Combined together, I think that the Corporate Form and the increasingly unregulated markets (notice I didn't say "Free") that we have will eventually end with a severely weakened governmental system and a rise of corporate systems to fill the power gap. Then we will have a new beginning of Fedualism.

Re:Very unpopular sentiment

[cpt kangarooski]

At least, until we change our tort laws so that the maximum payout is the maximum input.

So if you get sick from a hamburger, fine, you get your money back, but thats all, not 40 million dollars. Otherwise, corporate limited liability MUST stay.

That is the stupidest, most unjust thing I've seen today.

The idea of tort law is to make the victims of a tort whole, and to discourage tortfeasors and other potential tortfeasors from harming anyone else similarly.

If you get sick from a hamburger, then yes, I suppose you'd have a warranty claim for the burger having been defective, in which case the appropriate remedy would be the price of the burger.

But that's totally beside the point that the burger made you sick, causing you to rack up medical bills, lose income because you can't work, caused you pain and suffering, etc. To even suggest that the price of the burger would be just compensation for what could be quite significant injuries, is simply cruel of you.

In any event, limited liability merely refers to the liability of investors (who cannot lose more money than they invested -- i.e. if you buy $50 of stock in WidgetCo, and they go out of business, you only lose that $50) and that's it. The corporation itself is not shielded from liability, nor should it be. And its officers and management, in their capacities as such, are not particularly shielded either, though their concerns are less about tort liability and more about liability to the investors, to whom they owe a duty.

'Please don't regulate me'

[maynard]

"That's the general consensus of a wide range of business executives and auditors who gathered Wednesday in Washington, D.C., for an all-day roundtable hosted by the U.S. Securities and Exchange Commission and the Public Company Accounting Oversight Board (PCAOB)."

Uhhh, so who is networkworld.com, why should I believe what the regulated have to say to the regulators, and why did the article summary assert what they stated to congress as certain truth?

SOX as Damage

[bill_mcgonigle]

I appears Corporate America is viewing SOX as damage and attempting to route around it. The Charlie Rose Show had on a couple of the biggest private equity fund managers the other night and they were talking about companies which are moving headquarters and operations off-shore because of SOX. They hate it.

However well-intentioned SOX is/was, if this trend continues, we don't get the SOX purported benefits, and we lose the economic benefits of these companies on US soil.

Re:SOX as Damage

[Shelled]

Doesn't work if their stock trades on an American exchange. I work in Canada for a Canadian company and we're obliged to adhere to SOx because our stock trades on Wall Street. Thank you Enron, for making your dishonesty international.

I think you are confused.

[Belial6]

I think you have gotten the words "Everybody" and "Somebody" confused.

It also costs *us*

[Space cowboy]

Because now, if there are *any* new features in an update to a program, the company who created it *must* charge for that upgrade. This totally changes how software is developed and marketed...

Previously, if I had a program I wanted to release for profit, I would do the core features well, and add modules on around the side later, at extra cost. I might release interim patches for any bugs found in the field, and as a sweetener, upgrade some small functionality to get users affected by the bug back on "my side".

Now, I can't do that. The only time I can have a free interim release is to fix bugs - no new features are allowed. I'm no lawyer, but this is (expensive) legal opinion. So the dynamic changes - in order for me to have the most flexible release policy, I'm *far* better off releasing bug-ridden software that does *everything* - even if it only does it badly. Following this path, I get a choice of how to proceed later (I can add functionality *by* fixing "bugs" (ahem) by actually making a serious attempt to provide the functionality I promised in the first place). I can gauge the market and give it away free if that suits my needs at the time.

Now there's a downside to releasing bug-ridden software (and we're all aware of the arguments). The problem with this (responsible) attitude is that the collective consciousness of consumers today seems to not have a problem with buggy software - software crashes all the time, they're used to it, and it's a self-propogating meme of "what is normal". Responsibility don't pay.

So, when I release software (under the usual constraints of "good,cheap,fast - pick any two") I'm being pushed in the direction of "cheap and fast" because there's no real downside to me, and I get a lot more flexibility with dealing with the resulting debacle. I can balance my budget better ("cheap") and I get to market faster ("fast"). The fact that it doesn't work so well isn't really an issue.

That's what Sarbanes-Oxley has done for us.

For the record, I don't release software - please direct hate-mail to /dev/null. But if I were a software company, I sure-as-hell would be looking for an upside in the SO legislation, and I don't see any other "good" routes...

Simon

Bring back Glass-Steagall

[Raul654]

I'm 100% in favor of bringing back the Glass-Steagall Act, a useful bit of post-Depression legislation that would probably have prevented Enron (or, at the very least, significantly reduced the overall damage). Glass-Steagall ruled that a company could not do both finincial analysis and investment banking, because it's a conflict of interest to be evalauting the same companies you have intestments in. Thanks to the Republicans, Glass-Steagall was repealed in 1999 (although, to be fair, Bill Clinton did sign the law repealing it).

Re:Bring back Glass-Steagall

[Megane]

If it passed with greater than 2/3rds majority, then a lot of Democrats must have voted for it, too.

The Biggest Problem With SOX

[MCTFB]

is in spite of the complaining by companies in the Fortune 500, the relative costs of SOX are low for mega-corporations like General Electric compared to a medium-sized business looking to try and compete with the big guys. Just as many well-intentioned business regulations are designed to keep the biggest and the baddest companies from screwing the public, the biggest unintended consequence of most business regulations is that these same regulations stifle up and coming competition whose resources might be scarce and the difference between spending 33 million dollars on SOX compliance is the difference between being a viable competitor in some market and being bankrupt.

Of course SOX doesn't affect small businesses, but if you ever want to become grow and become a big business, then you are taking an extra risk once you reach the threshold of employees that forces you to effectively making paper log files of every single form of correspondence in the company. For the Fortune 500 guys, not having to worry about competition from new competition is a big win for them, and for any aspiring entrepreneur a big loss that makes you wonder if you would be better off expatriating to another country and starting your business offshore where the success or failure of your business is not tied exclusively to how efficient you are at dealing with government regulations.

Let shareholders judge the value

[bagsc]

GE's Section 404 controls cost: $33 million
GE's Market Cap: $365 billion
Percentage of Capital spent to make sure they're honest: .09%

As a GE stockholder, I'm happy with that. I will always be willing to pay .1% to ensure I don't lose 100%.

Re:Let shareholders judge the value

[MCTFB]

Is GE the only company out there who has to comply with SOX? What about the companies spending up to 10% of their revenue for 404 compliance. Just as Wal-Mart can have economies of scale when doing retail operations, any megacorp has an economy of scale in complying with SOX. Excessive government regulation has a crippling effect on small businesses and medium-sized businesses that you never hear about from the sensationalist news outlets out there. These companies and their owners are invisible as far as the masses are concerned.

All the masses care about is that guys like Kenneth Lay get stuck in a "Federal Pound You In The Ass Prison", while a lot of other companies are forced to waste scarce resources they could be using to hire more employees or else be forced into the dire choice of offshoring or inevitable bankruptcy.

It is ironic that a lot of Slashdotters seem to complain about being the victims of offshoring, but at the same time they defend laws which help to eliminate their jobs at the same time.

404

[tehwebguy]

The SEC and PCAOB arranged the roundtable to solicit feedback about Section 404 of the legislation, which Could Not Be Found...

Duh, I could have told them that.

[Banner]

I've worked with sarbanes-oxley, it's a joke, and sadly the joke is on us. It really doesn't do anything good, it's just a knee jerk beauracratic response to increase the number of beauracrates.

boondoggle

[eronysis]

I believe SOx was indeed well intended, however if you have ever dealt with these auditors you would quickly realize that in practice SOx ended up as a boondoggle to a few very large accounting firms. I have actually dealt with "auditors" who requested(upon me asking about where he was based and that I speak the language) I speak in spanish, as they were based in mexico city on contract...He then asked for a screenshot of /etc/passwd, not the file itself mind you a screenshot of a pwd at the path! Not that the file would do much good as my boxes are all trusted . Idiots driving idiots

As usual, it's the "experts" who make the money.

[SeaDuck79]

I've had to follow after some of these consultants, since I work in a related industry. I've seen companies so scared to do anything that they're in process paralysis, because some SOX consultant was paid $250/hr to tell them they were going to jail in a handbasket if they didn't lock down everything that moved. Some listen when I tell them that all they have to have is good logging and a multiple-entity approval/decision tree, but some are just to shell-shocked. Unchecked Corporate greed has always been around, and does need to be regulated, but SOX is just another another example of something that government made worse.

Industry quibblers brought it on themselves

[A nonymous Coward]

I know far too many people who make excuses for Enron, saying they did nothing illegal, that California especially set itself up for disaster by deregulating only half the eletrical market.

But you know what? There are a zillion things any of us could do every day that are legal but immoral. Enron had no morals. They may have had great legal advice on how to skirt the edge, but their own admissions in email and memo, show they knew it was immoral. When the wholesale price of electricity jumps from 3 sents to 300 cents and stays there for exactly one hour before falling back down, something is wrong, whether legal or not.

Just as I have no respect for cops who complain about getting no respect when they won't turn in corrupt fellow cops, I shed no tears for business people who can't keep their own chicken coop clean.

This is the price you pay. You fuck with the public long enough, the public will fuck you back. Hell yes, it may be bad for business, but what they were doing was worse for society. So lump it, business boys and girls. You clean up your act, police yourselves, and earn the repeal or reform of SOX. Until then, I rejoice in what it does. Society is better off with the scoundrels roped in. Even if that small section of soceity call business is suffering a bit, society as a whole is better off.

Main problem...

[sheldon]

Nobody knows what Sarbanes-Oxley means...

I've had a lot of managers say we have to do such and such for SOX compliance. When I inquire as to more detail... Like what exactly, so I can make sure the solution fits within the requirements. I get blank stares.

That's a large part of the cost. The law itself is not a bad idea. It's just nobody knows how to comply.

Re:Business is not only a small corner of society

[Bob_Robertson]

The problem being that business isn't a small part of society. It is a major portion of how people interact.

Most of my interactions with other people, from a subscription to the YMCA to where I stop for cigarettes to the people I work with to the decision to mow my own lawn or hire a gardener, are business related.

The moment I step out of my door, which I bought, the actual number of people I deal with on a purely social level as opposed to the number of farmers, butchers, bakers, candlestick makers that I deal with on a business basis is very close to vanishingly small.

What reason do I have to be able to type to you this message but the ISP who doesn't know me on a social level at all, the Tier1 IP provider that doesn't know I exist at all, the Slashdot administrators trying to make a living by advertisements for which I am merely one few bytes of data in their database?

If it weren't for business, the price of tea in China would be irrelevant. But the fact is that by means of business, the price of tea in China is directly related to the price I see on the box of Oolong on my grocers shelf (who otherwise would have no interaction with me what so ever).

I think you need to look up the word "praxeology".

Bob-

SOX Never Ends

[wirq_1047]

My IT Consulting firm has a large client that hired a team of SOX Consultants to get them SOX compliant. Everytime they seemed to have checked off every item on the SOX Consulting team's list they were presented with a new list of items they must correct to be SOX compliant. Eventually they hired another SOX Consulting firm and had their suspicions confirmed that the first group was basically "inventing" reasons they were not SOX compliant to rack up a truly obscene number of billable hours.

Bzzzt. Wrong.

[Kadin2048]

This is wrong on any number of levels.

First, realize that the majority of stock in the US isn't owned by rich individuals. It's owned mostly by mutual funds, which are in turn used as part of basically every retirement plan, investment account, college-savings plan, ad infinium. If you have a 401k, you probably are an indirect shareholder in Exxon-Mobil (and IBM, and Microsoft, and General Dynamics, and probably Halliburton). If any of the big oil companies were to sneeze, the whole economy would get a cold.

Second, high-priced petroleum products, especially gasoline, is not necessarily a Bad Thing. I think it sucks as much as the next guy -- if I could click my shoes together and go back to the days of 98-cent per gallon gas forever, I'd be doing it and buying a Camaro before you could say "carbon dioxide." As much as Ma and Pa Jones of Pig's Knuckle, AR think that they want the Gubbermint to step in and 'do something' about the high price of gas, they really don't. Because keeping the price of gas low will only ensure that it gets used up faster, and that we don't do a damn thing to change our usage patterns or wean outselves off of it before it runs out completely.

In other words, cheap gasoline just makes us, as a nation, press the accelerator to the floor as we're heading towards the brick wall of No More Petroleum. Paying the real market price for gas is the fairest way to wean everybody off of petroleum products: and people are listening. Go down to a Toyota garage sometime and see how many people are looking at hybrids, versus a year or two ago. The difference is pretty impressive.

The oil companies will continue to charge what they think the market will bear for gasoline and other products; when the cost of transportation fuels starts to become a major source of pain to American families, they will modify their usage patterns. This is how things have to work: people have to understand that the era of cheap gasoline -- probably of cheap fuel in general -- is over. In the future, if you want to drive 300 miles to see Grandma instead of call her, you're going to have to factor in the $30-40 in fuel that it's going to cost you. That's reality; that's life.

I have no doubt that many politicians this election year will try to come up with all sorts of creative ways of basically subsidizing or otherwise artificially deflating the price of gas. But as they're doing their financial rabbits-from-hats routine, I think it's worth it for everyone to remember that "cheaper gas" doesn't equal "more gas." In fact, it really means 'less gas' for everyone in the future.

Having dealt with SOX compliance...

[itzmejoey]

...for the past 18 months, my biggest beef is that it does absolutely nothing to prevent any sort of catastrophe -- it just ensures that the catastrophy is logged in exquisite detail.

As a developer, certain procedures and responsibilities have always rested on my shoulders. I'm used to it, and I rely on them to help me do a better job. However, with the advent of SOX compliance, so many layers of crap are added to my workflow that I end up spending 4 hours documenting a 20-second fix to correct a spelling error in a piece of code.

If these new procedures were to give me any sort of confidence that my fix not only addressed the problem, but didn't cause any new ones, then I would be more open to accept them as part of my job. As it stands, though, it only extends the amount of time that potentially Bad Stuff(TM) takes to make it into production.

Even with supposedly airtight SOX-compliant controls in place, any developer at my company can easily mangle production environments at any time. Here's why: one of the big things they started off with when implementing SOX controls was that if you were a developer, you shouldn't have direct access to production systems. So, they add a few layers in there. You, the developer, can't touch production, but you can write a script and give it to someone in a "responsible position", who can then run it in production. Problem is, the person who's supposedly responsible for the system often times has no clue what the script does -- even if they actually bothered to look at the script in the first place. They may ask you what it does, simply because they need to appear to be doing their job, but does it really matter what the answer is? They blindly run the script and send you the output. They don't know what the script does, so they don't know whether the output is valid. You tell them everything looks good. Everyone's happy.

Doesn't matter whether you update a single row, or drop a table with 70 million rows -- no one involved in the process is going to actually take the time to look at what you're doing in order to determine that it does what you say it does. As long as you've convinced people you know what you're doing, you have free reign. The addition of SOX hasn't changed this. The only benefit (if you wanna call it that) I can see is that now, you've got a pile of documentation showing that 4 people assisted you in wiping out data that will take days to retrieve from tape. The only way that controls are worthwhile is if they truly prevent this sort of thing.

*sigh*

[JKConsult]

I'm making these comments in virtually every subthread, so I thought I'd just bring them all to the front.

1) For those who are claiming that the implementation/specific requirements are too strict, could you give an example? I have had to do things required for SOX compliance (and I know of plenty of other things that my company, and others, have done), and I have to say, I have yet to see anything that I consider overly burdensome. And certainly not so overly burdensome that they outweigh the benefits of the intended effect of SOX: ensuring more accurate and honest reporting in filings by public companies, and ensuring that management is held responsible for what is in those filings.

2) For those who are claiming that the original intent of SOX is wrong, could you please explain why you think so in those parameters? There are certainly downsides to SOX, but a million posts saying "SOX sucks" or "I have to do a whole bunch of extra things so that my company is SOX compliant" doesn't mean anything. First, obviously it doesn't provide any kind of example. Second, there's no reasoned logic as to why these downsides are worse than the upsides. Which leads me to...

3) For those who are claiming that the original intent was good, but the implementation is faulty, again, could you provide examples? Personally, I feel that extra work for you (or your accounting department, or whoever) is worth it if it helps to ensure that 10-Ks and the like are as accurate as possible. There is certainly a point at which the expense to make them more accurate outweighs the benefit of that improved accuracy. But remember, as I pointed out upthread, these filings are not FOR the company, or even really FOR the government (nearly every company has two sets of books, one for tax purposes and one for annual reports); they're for you, me, and every other person (and institutional investors) trying to decide whether investing in that company, be it through stocks, bonds, or any other avenue, is a good investment. The purpose of these filings and the role of the government in ensuring the accuracy of those filings is to make sure that investors have as much (and as accurate) information as possible. This is a good thing. If you'd like to argue that it's not, I (and probably others) will be happy to do so. If you're simply trying to point out that SOX doesn't fulfill its intent, then please, please say WHY you think that, and please give some thought to how much more work you would be willing to put up with, and how much expense you think is acceptable for a company to incur, to help the markets get better information.

4) Finally, there is a very interesting argument against SOX that is getting ignored upthread. SOX is definitely a regressive expense. Small businesses are paying a higher percentage of their revenue (or pre-tax income, if you want to be pedantic) than larger companies. Is this fair? What, if anything, can be done to alleviate that problem? What slope of regression (I'm probably butchering this terminology-wise, but I think you know what I mean) is acceptable to you, assuming you believe that SOX is otherwise a net benefit?

On the whole, obviously I am in favor of SOX. I wholeheartedly agree with the thought process behind it, and in my experiences dealing with it, I haven't found anything to change my mind. If you disagree, let's talk about it. This is a very, very important issue. But let's talk about it rationally and logically. Throwing out "it sucks", "I hate SOX", and "It doesn't work" don't do anything to further the discussion.

And yes, I am a longtime Slashdot reader, and I know that it's sometimes hard to find real, thought-out discussion. But we can certainly try for it.

Re:Don't like the law?

[rdean400]

It's a big, bad issue and Congress must act...before the corrupt party gets thrown out of office and we have to start all over bribing a new set of lawmakers.

I think you're not being honest here. You should replace "bribing a new set of lawmakers" with "bribing the other corrupt party".