Slashdot Mirror
Sarbanes-Oxley Costs Exceed Benefits
coondoggie writes "Two years of compliance with the Sarbanes-Oxley Act (SOX) have shored up corporate accounting practices - but with lopsided costs compared to benefits gained.
Bill Gradison, acting chairman of the Public Company Accounting Oversight Board (PCAOB), said that guidance the SEC issued last year and PCAOB's latest auditing standard may not be enough to clarify the rules that govern the reporting and auditing of internal controls. 'Based on the information we already have, it would seem that some further changes may be in order,' Gradison said."
I have quite a bit of experience with Sarbanes-Oxley and UNIX compliance. One weak area is auditing root and shared account access. Generally the developers know the application account's password (like oracle or db2) and it's really hard to audit who did what. I created the tool Enterprise Audit Shell (EAS) which centrally logs shell access and sessions in an enterprise environment. Sessions can be snooped in real-time or played back at a later time. Each session is digitally signed and transmitted via OpenSSL. Project Site http://sourceforge.net/projects/eash Support Forum http://eas.strchr.net/
Government regulation always increases costs, because the regulation has costs of compliance.
Crooks don't comply, because they're crooks.
Customers, that's us, end up with higher prices for the things we buy, and higher taxes to pay for all the new auditors.
Martha Stewart goes to jail while the real criminals get away with what they've always gotten away with.
Politicians get reelected for having "done something".
To quote from the movie Spartacus, "I'll take a little republican [style of government, not party] corruption, along with republican freedom!"
Want to really put the screws to "corporate executive" crime? Then eliminate the government granted limited liability that a "corporation" represents. Allow thereby the officers of a company to be directly liable for their decisions, their accounting practices, their performance.
It's easy to follow the Big Lies handed down by the sensationalist press that don't want you looking at their own corporations and unions. S-O doesn't solve anything. It merely adds another layer of bureaucracy to the effort of getting anything accomplished.
Bob-
The Ludwig von Mises Institute. The reasoning individuals economics
Meanwhile, financial companies, especially hedge funds, are increasingly choosing to set up shop in London rather than New York/Connecticut to escape the burdens of Sarbanes-Oxley and SEC registration. Like them or not, these entities contribute a huge amount of money to local coffers: investors flock from all over the world to place capital in hedge funds, and they leave generally 2% of the investment and 20% of the profit annually with the fund managers.
No-one wants more catastrophes like Enron, but that doesn't mean we should throw the baby out with the bathwater.
Please, for the love of God, no more car analogies.
I appears Corporate America is viewing SOX as damage and attempting to route around it. The Charlie Rose Show had on a couple of the biggest private equity fund managers the other night and they were talking about companies which are moving headquarters and operations off-shore because of SOX. They hate it.
However well-intentioned SOX is/was, if this trend continues, we don't get the SOX purported benefits, and we lose the economic benefits of these companies on US soil.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
Exactly. This article from November says exactly the same thing:
http://blog.mises.org/archives/004345.asp
"In contrast, the CEO of Georgia Pacific explained that his company sold out to private Koch Industries in order to avoid mounting Sarbox costs."
and
"No doubt, a company that had poor controls may have improved them in order to comply with Sarbox. This does not mean that U.S. businesses in aggregate benefited from Sarbox. A law mandating a 45% increase in marketing spending might help some companies too, but it would cripple most others. Even companies with superior internal controls were forced by this perverse law to spend more money on internal controls."
The Ludwig von Mises Institute. The reasoning individuals economics
Because now, if there are *any* new features in an update to a program, the company who created it *must* charge for that upgrade. This totally changes how software is developed and marketed...
/dev/null. But if I were a software company, I sure-as-hell would be looking for an upside in the SO legislation, and I don't see any other "good" routes...
Previously, if I had a program I wanted to release for profit, I would do the core features well, and add modules on around the side later, at extra cost. I might release interim patches for any bugs found in the field, and as a sweetener, upgrade some small functionality to get users affected by the bug back on "my side".
Now, I can't do that. The only time I can have a free interim release is to fix bugs - no new features are allowed. I'm no lawyer, but this is (expensive) legal opinion. So the dynamic changes - in order for me to have the most flexible release policy, I'm *far* better off releasing bug-ridden software that does *everything* - even if it only does it badly. Following this path, I get a choice of how to proceed later (I can add functionality *by* fixing "bugs" (ahem) by actually making a serious attempt to provide the functionality I promised in the first place). I can gauge the market and give it away free if that suits my needs at the time.
Now there's a downside to releasing bug-ridden software (and we're all aware of the arguments). The problem with this (responsible) attitude is that the collective consciousness of consumers today seems to not have a problem with buggy software - software crashes all the time, they're used to it, and it's a self-propogating meme of "what is normal". Responsibility don't pay.
So, when I release software (under the usual constraints of "good,cheap,fast - pick any two") I'm being pushed in the direction of "cheap and fast" because there's no real downside to me, and I get a lot more flexibility with dealing with the resulting debacle. I can balance my budget better ("cheap") and I get to market faster ("fast"). The fact that it doesn't work so well isn't really an issue.
That's what Sarbanes-Oxley has done for us.
For the record, I don't release software - please direct hate-mail to
Simon
Physicists get Hadrons!
I'm 100% in favor of bringing back the Glass-Steagall Act, a useful bit of post-Depression legislation that would probably have prevented Enron (or, at the very least, significantly reduced the overall damage). Glass-Steagall ruled that a company could not do both finincial analysis and investment banking, because it's a conflict of interest to be evalauting the same companies you have intestments in. Thanks to the Republicans, Glass-Steagall was repealed in 1999 (although, to be fair, Bill Clinton did sign the law repealing it).
To make laws that man cannot, and will not obey, serves to bring all law into contempt.
--E.C. Stanton
The SEC and PCAOB arranged the roundtable to solicit feedback about Section 404 of the legislation, which Could Not Be Found...
-- lol pwned
Using your same logic, here in the US we should also repeal child labor laws, environmental regulation, and occupational safety laws, merely because many US companies will open shop in in other countries where there are looser pollution regulation, safety laws, etc. Think of how much business the US economy is missing out on due to these regulations pushed by 'liberals'.
The scary thing is that a typical pro-big-business Republican would agree wholeheartedly with my paragraph, without sensing its sarcasm.
Sarbanes-Oxley is a *very good thing* - it exists to prevent another Enron
No, it's killing a butterfly with a cannon. Because one company was run by a bunch of crooks, every other public company has to vastly increase their costs, which is money that isn't spent of improving their products, hiring more workers, or cutting prices to their customers.
Let me point out that it was the market that brought Enron down, not the government.
-jcr
The only title of honor that a tyrant can grant is "Enemy of the State."
SOX has reduced my productivity by 75%.
I spend the rest of the time (15 to 20 hours per project) filling out several forms that I didn't used to have to fill out, doing self-audits to confirm I filled out the forms, waiting for approval of my forms before I can go to the next step, etc.
Meanwhile- the execs in my company can write a $20,000 check without even a counter-signature from another exec and much larger checks with a counter-sig from *one* other exec with NO required paperwork of any kind and they get paid literally millions of dollars while our stock has declined constantly in price for years.
Why the heck sox means the "Massive Paperwork for Programmers" is beyond me.
And then when we have a high priority project that a big executive wants fast-- we toss all the paper work out the window and backfill it afterwards (even putting links to empty documents that will be filled in later).
Yea right- sox is a very good thing-- NOT. We already had laws against fraud. All we have to do is start ENFORCING them.
She was like chocolate when she drank... semi-sweet at first and then increasingly bitter.
You're forgetting an important fact. A LARGE percentage of America is knowingly or unknowingly a shareholder in oil companies. You know that retirement plan you have? Your 401k? Those mutual funds you bought? Guess what they include as part of your portfolio? That's right. Shares in those horrible oil companies. The American public loses sight of the fact that while high gas prices certainly hurt your pocketbook right now, there's a silver lining... in the long run, it's actually building up your retirement fund.
Now that's not to say I'm happy with the oil companies. Along with a responsibility to please your shareholders, an ethical company also has a responsibility to act for the benefit of society when they can. In the oil companies' cases, this would mean pumping some of those huge profits into R&D and building new refineries so that we have the capacity to keep artificial shortages from happening.
Just saying though... with the amount of people who hold shares in these companies either directly or through mutual funds, the actions that are best for shareholders might actually be those that are best for society in the long run.
While slashdotters may derive a justified modicum of rightously deserved glee in this state of affairs - who here hasn't been given like orders - the economic waste on the national scale is so hideous that it needs airing. Never before has so much money been wasted on useless butt-plate.
The concept here is that corporate processes need to be audited independently to prevent fraud and malfeasance. Wonderful idea. What the SEC people had no clue about, however, was just how many processes there are churning away every day in a normal company. There are thousands! If you want to monitor the pain Sarbox is inflicting, subscribe to the alerts from CFO.com. For example, one company just found out it would have to pay its auditors - that's right, the people who failed to catch Enron's malfeaseance - $50,000 a year just to audit its employees vacations. That's not so much alone, but when you multiply it by everything going on in a company, the costs are absolutely humongous. And all of this money is going to the people who not only failed to prevent Enron but told them how to do it. Something is seriously wrong here.
Proportionately, the costs for smaller businesses are much higher (typically 20x). This has an anti-technology bias that hurts all of us in technology and eventually the whole economy. Because our start-ups are small and Sarbox denies us capital, we will not be able to hire and develop. This is bad Kool-Aid.
The supporters of Sarbox are: a) Big Labor - they are more successful unionizing big/old companies, fail miserably with high-tech startups, hate us, and actively seek to ruin us, b) Auditors - they make the money from this regulation, c) Regulators - from their perspective, regulation is always good and Sarbox means hiring many more of them.
The losers are everyone else, especially us in the tecnhology sector. I'm developing technology that could make corporate treasuries more efficient by increasing their control of liquid assets. I cannot sell it because of Sarbox and all its distractions. Ironically, corporate treasuries are so involved in dealing with the worthless regulatory minutia of Sarbox that they cannot invest the time to evaluate systems that would actually improve their control of corporate liquid assets.
I wish I could conclude this rant by recommending what we should do, but I am not as politically astute as our foes. All I can say is let's hope for the best and maybe someone out there in the political world will get a clue.
Nobody knows what Sarbanes-Oxley means...
I've had a lot of managers say we have to do such and such for SOX compliance. When I inquire as to more detail... Like what exactly, so I can make sure the solution fits within the requirements. I get blank stares.
That's a large part of the cost. The law itself is not a bad idea. It's just nobody knows how to comply.
The problem being that business isn't a small part of society. It is a major portion of how people interact.
Most of my interactions with other people, from a subscription to the YMCA to where I stop for cigarettes to the people I work with to the decision to mow my own lawn or hire a gardener, are business related.
The moment I step out of my door, which I bought, the actual number of people I deal with on a purely social level as opposed to the number of farmers, butchers, bakers, candlestick makers that I deal with on a business basis is very close to vanishingly small.
What reason do I have to be able to type to you this message but the ISP who doesn't know me on a social level at all, the Tier1 IP provider that doesn't know I exist at all, the Slashdot administrators trying to make a living by advertisements for which I am merely one few bytes of data in their database?
If it weren't for business, the price of tea in China would be irrelevant. But the fact is that by means of business, the price of tea in China is directly related to the price I see on the box of Oolong on my grocers shelf (who otherwise would have no interaction with me what so ever).
I think you need to look up the word "praxeology".
Bob-
The Ludwig von Mises Institute. The reasoning individuals economics
This is wrong on any number of levels.
First, realize that the majority of stock in the US isn't owned by rich individuals. It's owned mostly by mutual funds, which are in turn used as part of basically every retirement plan, investment account, college-savings plan, ad infinium. If you have a 401k, you probably are an indirect shareholder in Exxon-Mobil (and IBM, and Microsoft, and General Dynamics, and probably Halliburton). If any of the big oil companies were to sneeze, the whole economy would get a cold.
Second, high-priced petroleum products, especially gasoline, is not necessarily a Bad Thing. I think it sucks as much as the next guy -- if I could click my shoes together and go back to the days of 98-cent per gallon gas forever, I'd be doing it and buying a Camaro before you could say "carbon dioxide." As much as Ma and Pa Jones of Pig's Knuckle, AR think that they want the Gubbermint to step in and 'do something' about the high price of gas, they really don't. Because keeping the price of gas low will only ensure that it gets used up faster, and that we don't do a damn thing to change our usage patterns or wean outselves off of it before it runs out completely.
In other words, cheap gasoline just makes us, as a nation, press the accelerator to the floor as we're heading towards the brick wall of No More Petroleum. Paying the real market price for gas is the fairest way to wean everybody off of petroleum products: and people are listening. Go down to a Toyota garage sometime and see how many people are looking at hybrids, versus a year or two ago. The difference is pretty impressive.
The oil companies will continue to charge what they think the market will bear for gasoline and other products; when the cost of transportation fuels starts to become a major source of pain to American families, they will modify their usage patterns. This is how things have to work: people have to understand that the era of cheap gasoline -- probably of cheap fuel in general -- is over. In the future, if you want to drive 300 miles to see Grandma instead of call her, you're going to have to factor in the $30-40 in fuel that it's going to cost you. That's reality; that's life.
I have no doubt that many politicians this election year will try to come up with all sorts of creative ways of basically subsidizing or otherwise artificially deflating the price of gas. But as they're doing their financial rabbits-from-hats routine, I think it's worth it for everyone to remember that "cheaper gas" doesn't equal "more gas." In fact, it really means 'less gas' for everyone in the future.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
...for the past 18 months, my biggest beef is that it does absolutely nothing to prevent any sort of catastrophe -- it just ensures that the catastrophy is logged in exquisite detail.
As a developer, certain procedures and responsibilities have always rested on my shoulders. I'm used to it, and I rely on them to help me do a better job. However, with the advent of SOX compliance, so many layers of crap are added to my workflow that I end up spending 4 hours documenting a 20-second fix to correct a spelling error in a piece of code.
If these new procedures were to give me any sort of confidence that my fix not only addressed the problem, but didn't cause any new ones, then I would be more open to accept them as part of my job. As it stands, though, it only extends the amount of time that potentially Bad Stuff(TM) takes to make it into production.
Even with supposedly airtight SOX-compliant controls in place, any developer at my company can easily mangle production environments at any time. Here's why: one of the big things they started off with when implementing SOX controls was that if you were a developer, you shouldn't have direct access to production systems. So, they add a few layers in there. You, the developer, can't touch production, but you can write a script and give it to someone in a "responsible position", who can then run it in production. Problem is, the person who's supposedly responsible for the system often times has no clue what the script does -- even if they actually bothered to look at the script in the first place. They may ask you what it does, simply because they need to appear to be doing their job, but does it really matter what the answer is? They blindly run the script and send you the output. They don't know what the script does, so they don't know whether the output is valid. You tell them everything looks good. Everyone's happy.
Doesn't matter whether you update a single row, or drop a table with 70 million rows -- no one involved in the process is going to actually take the time to look at what you're doing in order to determine that it does what you say it does. As long as you've convinced people you know what you're doing, you have free reign. The addition of SOX hasn't changed this. The only benefit (if you wanna call it that) I can see is that now, you've got a pile of documentation showing that 4 people assisted you in wiping out data that will take days to retrieve from tape. The only way that controls are worthwhile is if they truly prevent this sort of thing.
I'm making these comments in virtually every subthread, so I thought I'd just bring them all to the front.
1) For those who are claiming that the implementation/specific requirements are too strict, could you give an example? I have had to do things required for SOX compliance (and I know of plenty of other things that my company, and others, have done), and I have to say, I have yet to see anything that I consider overly burdensome. And certainly not so overly burdensome that they outweigh the benefits of the intended effect of SOX: ensuring more accurate and honest reporting in filings by public companies, and ensuring that management is held responsible for what is in those filings.
2) For those who are claiming that the original intent of SOX is wrong, could you please explain why you think so in those parameters? There are certainly downsides to SOX, but a million posts saying "SOX sucks" or "I have to do a whole bunch of extra things so that my company is SOX compliant" doesn't mean anything. First, obviously it doesn't provide any kind of example. Second, there's no reasoned logic as to why these downsides are worse than the upsides. Which leads me to...
3) For those who are claiming that the original intent was good, but the implementation is faulty, again, could you provide examples? Personally, I feel that extra work for you (or your accounting department, or whoever) is worth it if it helps to ensure that 10-Ks and the like are as accurate as possible. There is certainly a point at which the expense to make them more accurate outweighs the benefit of that improved accuracy. But remember, as I pointed out upthread, these filings are not FOR the company, or even really FOR the government (nearly every company has two sets of books, one for tax purposes and one for annual reports); they're for you, me, and every other person (and institutional investors) trying to decide whether investing in that company, be it through stocks, bonds, or any other avenue, is a good investment. The purpose of these filings and the role of the government in ensuring the accuracy of those filings is to make sure that investors have as much (and as accurate) information as possible. This is a good thing. If you'd like to argue that it's not, I (and probably others) will be happy to do so. If you're simply trying to point out that SOX doesn't fulfill its intent, then please, please say WHY you think that, and please give some thought to how much more work you would be willing to put up with, and how much expense you think is acceptable for a company to incur, to help the markets get better information.
4) Finally, there is a very interesting argument against SOX that is getting ignored upthread. SOX is definitely a regressive expense. Small businesses are paying a higher percentage of their revenue (or pre-tax income, if you want to be pedantic) than larger companies. Is this fair? What, if anything, can be done to alleviate that problem? What slope of regression (I'm probably butchering this terminology-wise, but I think you know what I mean) is acceptable to you, assuming you believe that SOX is otherwise a net benefit?
On the whole, obviously I am in favor of SOX. I wholeheartedly agree with the thought process behind it, and in my experiences dealing with it, I haven't found anything to change my mind. If you disagree, let's talk about it. This is a very, very important issue. But let's talk about it rationally and logically. Throwing out "it sucks", "I hate SOX", and "It doesn't work" don't do anything to further the discussion.
And yes, I am a longtime Slashdot reader, and I know that it's sometimes hard to find real, thought-out discussion. But we can certainly try for it.