Counting the Cost of Compliance

The Sarbanes-Oxley Act of 2002 was one of the most sweeping and controversial laws ever to hit a statute book – but what has the backlash been for corporate America? Business Management’s Julian Rogers investigates…

The fallout from the Enron and Worldcom scandals has been massive and far-reaching. Apart from the jail terms handed down to senior executives involved in the accounting cover-ups, public companies’ accounts have been put under the spotlight like never before. The tough measures have created new standards for accountability, and despite claims by critics of the Sarbanes-Oxley (SOX) Act that the compliance costs outweigh the actual benefits, the authorities have been determined to crack down on financial fraud and restore the confidence of disgruntled investors. Since the Act’s introduction, firms have seen compliance bills hit their balance sheets hard as costs have mushroomed, with a recent survey conducted by AMR Research finding that companies are expected to shell out US$6 billion on SOX compliance in 2006 alone.

Although costs have fallen over the years since the Act’s initial impact, many senior executives underestimated the amount of money and time that would need to be pumped into SOX. The law, which applies to all companies listed on the New York Stock Exchange (NYSE), comes with some strict deterrents to combat accounting mismanagement. Senior executives can expect to receive harsh fines or jail terms of up to 20 years if found guilty of fraudulent behavior resulting in the disclosure of inaccurate financial information. No longer can senior executives blame each other or the auditors for inaccurate financial reporting. On the downside, the legislation has raised concerns that it would deter executives from applying for top positions to avoid exposing themselves to potential scandal and criminal proceedings. Images of smartly dressed executives in handcuffs did little to allay those fears.

But it is the costs associated with SOX compliance that have angered managers the most. California-based communications and videoconference provider Polycom was one public company left reeling when the bills first arrived in the mailbox.

“It was a shock initially, and then it was a shock continually throughout the process because the fees kept going up,” explains Donald Floyd, VP of Corporate Governance and Internal Audit at Polycom. “Part of it was because the regulatory body did not have all the guidelines and standards in place when we started the process. As we got to the first year of compliance, the audit standards were still not set and we were sort of guessing as to what we thought we had to do. Once the actual standard came out we realized we needed to do a lot more, and when the extra auditors got involved they also quickly realized that it would take a lot more on their part so their fees went up over the course of the year. Then there was a lot of retesting that took place in the first year so those fees seemed to go up almost on a monthly basis, too. Not only were we shocked at the beginning, but we were shocked in the middle and shocked at the end as to how much it really cost.”

Smaller players in the market have also protested at being forced to pay disproportionately high compliance costs because of past scandals involving the big boys. Some public companies even took the bold decision to voluntarily delist from the NYSE because the cost of SOX compliance was deemed too expensive. Ohio Art Company – the makers of popular drawing toy Etch-a-Sketch – and car spray giant Earl Scheib are two firms that jumped ship. “The advantages of being a public reporting company are outweighed by the significant accounting, legal and administrative costs,” Ohio Art’s CEO William Killgallon was quoted as saying. But the regulations do not only affect those companies not based in the US. Any foreign business listed on the NYSE has to abide by the compliance requirements too. This has led some to pull out of the stock market and others to do u-turns on planned listings. The problem is that many see SOX as too much hassle.

Strict controls

As well as impacting on a company’s corporate governance, financial disclosures and accounting patterns, there was one part of the Act at the heart of concerns expressed by firms – Section 404. This requires bosses to enforce strict controls on financial reporting by in-house accounting teams. Companies are required to produce an internal control report to show that the figures are accurate and that adequate safeguards are in place to protect financial data. End-of-year reports must contain an assessment of the effectiveness of the internal controls, while the issuer’s audit team needs to vouch for its accuracy. The law also requires firms to establish independent audit committees, prohibits loans to company executives and provides protection for whistleblowers.

Paul Sharman, President and CEO of the Institute of Management Accountants, stresses that all of this means compliance costs have been enormous. “The impact has been dramatic,” he says. “It has had a substantial impact on organizations of all sizes, to the extent that small businesses are so impaired that active consideration is being given to an idea to allow 80 percent of all registered businesses not to comply. Any such move would clearly recognize the failure of the law and how ineffective and expensive it is. The cost has been massive for corporations, and when you distract the largest sector of the economy from doing its job, you lose competitive edge. You can see this from the number of new registrations being launched on the London Stock Exchange as opposed to the New York Stock Exchange, simply to avoid having to comply with Sarbanes-Oxley.

“One organization said that they spent US$125 million dollars in year one, of which US$95 million was spent in funding outside organizations to do documentation work and giving them guidance,” Sharman adds. “That, specifically, has a financial impact. Then you have the problem of people being distracted from doing creative and productive work by having to do documentation.”

However, Grace Hinchman, SVP of Financial Executives International, an association for CFOs, argues that costs associated with compliance are falling. “We have seen a downward trend in terms of costs of compliance for 404,” she suggests. “Section 404 is the biggest concern for US business in terms of compliance because it has been so expensive and difficult to enforce, and smaller companies do have a justification for being concerned about the cost of complying with that provision. There is some thought that if you are a public company, yes you should comply with the provisions of this act, but maybe the compliance requirements are not as rigorous or as demanding as you would see for a General Electric, a General Motors or an IBM. I think that the compliance process has been well executed and it seems to be working pretty well.”

Floyd, however, feels that smaller companies are using their size as an excuse to try to avoid SOX regulations. “It’s a cop out for small companies to say they are getting the short end of the stick,” he suggests. “Regardless of what controls you are going to put in place, if you are a public company, large or small, there are requirements that you have to comply with in order to be listed on the New York Stock Exchange. Just because you are small doesn’t mean you shouldn’t have a strong control environment.”

Big distraction

As well as costs, important company time has to be devoted to SOX. Two accounting professors at the University of Illinois estimated that companies spent 120 million hours in 2004 complying with SOX. They also suggested that outside auditors spent another 12 million hours. That equates to 132 million hours – or, to put it another way, 66,000 people working for one year on nothing else.

Company heads soon realized that they needed to make some big changes – especially in terms of how they ran their IT department – if they were going to get to grips with SOX. Indeed, new software packages sprang up on the market offering to cut time and costs significantly. However, Floyd, who took on the role of project leader in dealing with SOX compliance at Polycom, was unconvinced by the solutions on offer. “I took a look at the technology tools that were on the market in 2004 and was not really convinced that there was going to be a huge benefit,” he says. “It appeared that we really needed to get good understanding of our requirements first before trying to put in some sort of technology. Some of these tools are touted as being great saviors for companies in terms of being able to save audit time and so forth, but I’m not really sure that this is actually true. We looked at it again in 2005 but I still remain unconvinced that it is worth the investment.”

Experts all agree the costs have been steep, but how steep? According to one study that has attracted a lot of attention, SOX contributed significantly to wiping US$1.4 trillion off the value of the stock market. This startling amount comes from a study by Ivy Xiying Zhang, Assistant Professor of Accounting at the University of Minnesota. “This finding has attracted much attention from researchers and practitioners,” explains Zhang. “Some people question whether other contemporaneous economic bad news caused the huge negative return I found. To mitigate these concerns, I conducted additional analyses of other potential news events in the SOX legislative period but I found that other news was unlikely to be the driver of the huge loss in that period.” Zhang says some indirect costs of SOX compliance were not included in budgets by managers. “While SOX likely imposed significant direct compliance costs on firms, the indirect costs could be even greater. Executives have complained that complying with the details of the rules diverts their attention from normal business practices. Also, as SOX increases the litigation risks for executives, managers are likely to behave more conservatively than shareholders would prefer. These changes could have long-lasting and far-reaching influence on business practices.”

Zhang is also of the opinion that smaller players pay disproportionately high compliance fees. “The direct compliance costs of Section 404 are likely disproportionately higher for smaller firms, as part of the compliance costs is fixed. I find that small firms experienced higher returns around the announcement of deferring compliance with Section 404. This suggests that the deferment created significant cost savings for small firms. However, large firms could incur greater litigation costs after SOX increased the risk exposure of firms and executives.” Zhang adds: “Although there is little evidence that the number of securities lawsuits increased after SOX passage, some studies show that the amount of settlement increased. Large firms have deeper pockets and are more likely sued. They would incur greater costs to avoid lawsuits or to settle the suits.”

Stamping out irregularities

Despite the concerns expressed, the Securities and Exchange Commission (SEC) and the Public Company Accounting Oversight Board (PCAOB), created from the law, have been defiant in their efforts to stamp out financial abuses within public firms with the controversial Section 404. The aftermath of the Enron and Worldcom scandals created a bonanza for auditors and accounting firms – so much so that there has been a shortage of top professionals in the field. Critics argue that the leading audit firms are getting all the work, leading to artificially high fees due to a lack of competition.

Sharman says he would like to see accounting firms more flexible in their approach. “Right now, Sarbanes-Oxley implementation by the accounting firms is like being in a hotel room. You’ve got some underwear and some socks you want to have laundered; there are 20 items on the laundry checklist but only two apply to you, so you tick them off. However, the way the accounting firms are satisfying Sarbanes-Oxley is that they are looking at the entire list and saying ‘demonstrate to me that you don’t have an undershirt’. It is ridiculous. I think [companies] are being forced by their accounting firms to comply with ‘nit picky’ minutia simply to satisfy the concerns of the accounting firm.”

There is no doubt that SOX has been a contentious law, with the effects hitting the corporate world hard in the wallet. But despite the early, unforeseen time and expenses of the act, costs have fallen as senior executives have adapted to their roles and responsibilities. And despite the various criticisms, the Act is not without its proponents. Hinchman, for one, argues that the law has helped restore faith in public companies. “The Sarbanes-Oxley Act has done an awful lot to reassure the investing public in the confidence of the financial marketplace. It has been very positive in reinstating confidence in the financial markets, so that has played to the benefit of the economy. The compliance process has been well executed and tested and the costs should decline now that the processes are in place.”

She also suggests that the communication between the department heads has become much more open. “Right now they are much closer, much more integrated. A lot of the time, the CIO reports to the CFO who then reports to the CEO. That relationship has become much more integrated because a lot of the compliance tools for Sarbanes-Oxley are IT-driven. You really do need to have a much closer, hands-on relationship between the IT officer and the finance officer.”

This communication can only be good for business. But given the risk of large fines, jail-time and loss of reputation, are senior executives still willing to put their necks on the line? Are images of company bosses being marched into courts handcuffed and flanked by guards enough to deter managers from taking the top jobs? “I don’t think so,” says Floyd. “There is always a level of risk at higher-level positions. The cream always rises to the top so the good people will always take those positions and take up the challenges.”