What’s to be made
of the US Securities and Exchange Commission’s grant, on October 2, of yet
another extension of its deadline for small companies to have reports on their
internal controls by their independent auditors? (See Edith Orenstein’s FEI Blog – here and here.)
As the autumnal
season for influenza raises alarmist cries of epidemic, the comparison with an
improved but experimental vaccine seems apt.
The mandate of
section 404(b) of the Sarbanes-Oxley law is criticized as a boondoggle for the
accounting firms, or worse, by Tom
Selling (The Accounting Onion), and the whole issue of auditors' work on controls is thoroughly raked over by Francine McKenna (Re:The Auditors). And there were short-lived legislative moves in Washington to extend or make permanent the small-company compliance exemption -- see the October 30 Compliance Week.
In this context, there is much to contemplate.
To start – just as
with the question whether to submit to a shot against uncertain exposure to a
new type of swine flu – is there any real upside?
Veteran readers
here know my deeply skeptical view that Sarbox was never more than a knee-jerk
political feel-good exercise – going back to my July 20, 2002 column in the International Herald Tribune: “any
legislation receiving the bipartisan margin of 97-0 is bound to be
fundamentally defective.”
In the general
population, most will never even catch the flu at all, or at worst will spend a
few days of bed-ridden discomfort. Most public companies, likewise, operate
honestly and with generally satisfactory controls, or require only modest
treatment of their symptoms in order to return to good corporate health.
There are sectors
at special risk, to be sure. With new vaccines, officials struggle to identify
and set priorities and to deliver to the right targets – the elderly, the
infirm, the weakened. That’s tough enough, for expert epidemiologists and
public health professionals. Errors and oversights are unavoidable, as with any
system under human design, and there will be casualties.
No less, the
episodic outbreak of corporate malfeasance is unpreventable, and will strike a
percentage of the most exposed. But no regulatory system yet conceived has been
able to identify the “at risk” targets or find a way to avoid a non-zero victim
count.
Secondly, there are
the false negatives. Just as no vaccine provides protection against all
strains, especially the newly emergent and opportunistic, the large-company
experience with Section 404 has shown that Sarbanes-Oxley has failed to
inoculate the corporate world against continued out-breaks of business
dishonesty.
Attempts to
legislate virtue have been no more effective than a mandatory vaccination
program – whether among foreign companies with US-traded securities (Parmalat
and Satyam), or individual perpetrators (the convicted Bernie Madoff, the
accused Alan Stanford, and the recently-charged Raj Rajaratnam), or the long
list of fallen financial institutions (Bear, Citi, Lehman, AIG, Merrill, etc.)
whose cleanly-reported controls did not protect them from the fatal infection
of the credit market collapse.
Third and most
pernicious, there are the inevitable side effects.
It is mis-directed
and erroneous to ask whether corporate behavior has improved since the
post-Enron legislative spasm of 2002. Rather, Sarbox has never been fairly
measured for its negatives – extravagant costs, severe disruption of the
auditor-client dialog and relationship, and diminution of real value
contributed by the assurance process. Just as most flu victims recover full
good health, whether treated or not, the proper question is how the side effects
of Sarbox weigh against the evolved corporate governance and controls that
would have emerged in the normal cycle, had the law never been enacted at all.
Discussion of the
Sarbox cost-benefit analysis typically omits recognition that the equivalent of
“good health” practices was always in place. Just as preventive hand-washing
and use of Kleenex will fend off most routine contagions, the prohibitions on
false statements to investors under the American securities laws have a long
tradition of deterrence – imperfect, to be sure, but nothing is. So the proper
question is whether imposition of a universal requirement for additional
measures under Sarbox could justifiably alter the prevention calculus for the
better.
To conclude --
leave for another day, and soon, scrutiny of the potentially devastating
litigation exposures run by small companies and their auditors when the next
round of control failures show up in a renewed wave of investor
litigation.
For now, compare with a health-delivery marketplace where individual choice still counts. Conscientious consumers can weigh the potential benefits of an experimental new vaccine. They can consider the risks of side effects and possible false comforts, absorb the publicity from a profit-driven drug industry, and decide accordingly.
With Sarbox 404(b),
by contrast, unless a re-evaluation occurs while this latest deadline extension
is pending, small listed companies will have no choice but to bend over and
offer a fat and juicy target – to be stuck by a needle-wielding bureaucrat with the
fear-inducing cry, “I’m from the SEC, and this shot is for your own good.”
Thanks for joining this dialog. Please share
with friends and colleagues. And if not a subscriber, please join at the Main
page – easy, free and non-commercial.
Comments