The early years of this century were not kind to investors. In 2000-2001, the stock market recorded back-to-back years of losses for the first time since 1973-74. When the market suffered a third consecutive losing year in 2002, it did so for the first time since the Great Depression. On top of the late 90s bubble bursting, came a string of bad news that further eroded investor confidence: Repeated accounting scandals, of which Enron and WorldCom are merely the most notorious. A high profile investigation by New York's attorney general calling into question the integrity of stock market analysts. And so on.
In response, Congress cobbled together the "Public Company Accounting Reform and Investor Protection Act" of 2002 -- popularly known as the Sarbanes-Oxley Act (SOX for short). As he signed it into law, President Bush praised SOX for making "the most far-reaching reforms of American business practices since the time of Franklin Delano Roosevelt." Others have been less kind; Yale law professor Roberta Romano, for example, memorably called SOX "quack corporate governance."
Congress hoped SOX would restore investor confidence by curbing various corporate governance excesses, encouraging director independence from management, and especially by toughening up accounting standards so as to enhance capital market transparency and the integrity of disclosures. Whether any of these benefits have been achieved is debatable and, if so, any such benefits have proven almost impossible to quantify.
What is clear after four years experience with the Act is that the costs have been far higher than anyone expected. Worse yet, as I've documented in prior TCS columns, such as SOXing It to Small Businesses, those costs have been born disproportionately by small publicly held corporations.
In response to growing concern with the deleterious impact SOX appeared to be having on smaller firms, the Securities and Exchange Commission (SEC) set up an Advisory Committee to assess the affect SOX and other securities laws have on small public corporations. The Committee released its final report on April 23, 2006. In its report, the Committee concluded that the costs imposed on smaller public corporations by a number of key SOX provisions significantly exceeded any benefit those provisions provide investors.
In particular, the Committee focused on SOX § 404, which requires inclusion of internal control disclosures in each public corporation's annual report. This disclosure statement must include: (1) a written confirmation by which firm management acknowledges its responsibility for establishing and maintaining a system of internal controls and procedures for financial reporting; (2) an assessment, as of the end of the most recent fiscal year, of the effectiveness of the firm's internal controls; and (3) a written attestation by the firm's outside auditor confirming the adequacy and accuracy of those controls and procedures. The Committee explained that:
From the earliest stages of its implementation, Sarbanes-Oxley Act Section 404 has posed special challenges for smaller public companies. To some extent, the problems smaller companies have in complying with Section 404 are the problems of companies generally:
- lack of clear guidance;
- an unfamiliar regulatory environment;
- an unfriendly legal and enforcement atmosphere that diminishes the use and acceptance of professional judgment because of fears of second-guessing by regulators and the plaintiffs bar;
- a focus on detailed control activities by auditors; and
- the lack of sufficient resources and competencies in an area in which companies and auditors have previously placed less emphasis.
But because of their different operating structures, smaller public companies have felt the effects of Section 404 in a manner different from their larger counterparts. With more limited resources, fewer internal personnel and less revenue with which to offset both implementation costs and the disproportionate fixed costs of Section 404 compliance, these companies have been disproportionately subject to the burdens associated with Section 404 compliance.
Accordingly, the Committee gave highest priority to a set of recommendations that would create a system of "scaled" securities regulation under which the smallest public corporations would be subject to less extensive disclosure and auditing requirements. In particular, the Committee recommended that the SEC exempt the smallest public corporations from SOX § 404, so long as they have a qualified audit committee and have adopted a qualifying code of ethics for disclosure and audit practices.
On May 17, the SEC responded by -- to be blunt -- tossing the Advisory Committee report in the circular file. Instead of even considering the Committee's detailed recommendations, which had gone well beyond the narrow problems created by § 404, the SEC announced a modest set of regulatory actions limited solely to § 404 issues. Even within those narrow confines, moreover, the SEC's plans can only be described as lame:
- "The Commission expects to issue a Concept Release covering a variety of issues that might be the subject of Commission guidance for management. With the Concept Release, the Commission will solicit views on the management assessment process to ensure that the guidance the Commission ultimately proposes addresses the needs and concerns of all public companies. ... The Commission anticipates that this forthcoming guidance will help organizations of all sizes to better understand and apply the control framework as it relates to internal control over financial reporting. ... To ensure that this guidance is of help to non-accelerated filers and smaller public companies, the Commission intends that this future guidance will be scalable and responsive to their individual circumstances. ... The form of the guidance has yet to be determined." (Emphasis added.)
- Subject to SEC oversight, the Public Corporation Accounting Oversight Board (PCAOB) will amend its auditing standards so as to reduce costs to companies by focusing auditor attention on "areas that pose higher risk of fraud or material error."
- Small public corporations will get an extension on the date by which they are required to be fully compliant with § 404. "It is anticipated that any such postponement would nonetheless require all filers to comply with the management assessment required by Section 404(a) of Sarbanes-Oxley for fiscal years beginning on or after Dec. 16, 2006."
In sum, a couple of extra months before full compliance is required, a tweak to auditing standards that might reduce costs in one area, and unknown guidance to be provided in an unknown form.
Unlike the recommendations made by its own Advisory Committee, which would have provided significant and comprehensive regulatory relief for smaller public corporations, the SEC has taken a narrow and trivial approach to the problem. It's like using a band-aid to fix a gaping puncture wound.
Our capital market's bleeding thus is unlikely to be staunched by the SEC's action. Since SOX became law, our economy and capital markets have suffered from higher compliance costs in several ways:
- The number of companies going private (so-called "going dark") has increased dramatically, with many firms citing SOX compliance costs as a principal reason for choosing to do so
- A growing number of firms choosing to rely on retained earnings or private equity rather than raising money by going public via an IPO
- Pre-SOX, 9 out of the ten largest IPOs had a US component; in the last year, 9 out of the 10 largest were entirely foreign
- Fewer acquisitions and ADR offerings by foreign issuers
The bottom line? SOX is costing our economy the proverbial bundle and the SEC's response is little more than whistling past the graveyard.
