Sarbanes-Oxley 404(b): Auditors' Reports on Internal Controls -- A Shot in the Arm, or a Poke in the Behind?

What’s to be made of the US Securities and Exchange Commission’s grant, on October 2, of yet another extension of its deadline for small companies to have reports on their internal controls by their independent auditors? (See Edith Orenstein’s FEI Blog – here and here.)

As the autumnal season for influenza raises alarmist cries of epidemic, the comparison with an improved but experimental vaccine seems apt.

The mandate of section 404(b) of the Sarbanes-Oxley law is criticized as a boondoggle for the accounting firms, or worse, by Tom Selling (The Accounting Onion), and the whole issue of auditors' work on controls is thoroughly raked over by Francine McKenna (Re:The Auditors). And there were short-lived legislative moves in Washington to extend or make permanent the small-company compliance exemption -- see the October 30 Compliance Week.

In this context, there is much to contemplate.

To start – just as with the question whether to submit to a shot against uncertain exposure to a new type of swine flu – is there any real upside?

Veteran readers here know my deeply skeptical view that Sarbox was never more than a knee-jerk political feel-good exercise – going back to my July 20, 2002 column in the International Herald Tribune: “any legislation receiving the bipartisan margin of 97-0 is bound to be fundamentally defective.”

In the general population, most will never even catch the flu at all, or at worst will spend a few days of bed-ridden discomfort. Most public companies, likewise, operate honestly and with generally satisfactory controls, or require only modest treatment of their symptoms in order to return to good corporate health.

There are sectors at special risk, to be sure. With new vaccines, officials struggle to identify and set priorities and to deliver to the right targets – the elderly, the infirm, the weakened. That’s tough enough, for expert epidemiologists and public health professionals. Errors and oversights are unavoidable, as with any system under human design, and there will be casualties.

No less, the episodic outbreak of corporate malfeasance is unpreventable, and will strike a percentage of the most exposed. But no regulatory system yet conceived has been able to identify the “at risk” targets or find a way to avoid a non-zero victim count.

Secondly, there are the false negatives. Just as no vaccine provides protection against all strains, especially the newly emergent and opportunistic, the large-company experience with Section 404 has shown that Sarbanes-Oxley has failed to inoculate the corporate world against continued out-breaks of business dishonesty.

Attempts to legislate virtue have been no more effective than a mandatory vaccination program – whether among foreign companies with US-traded securities (Parmalat and Satyam), or individual perpetrators (the convicted Bernie Madoff, the accused Alan Stanford, and the recently-charged Raj Rajaratnam), or the long list of fallen financial institutions (Bear, Citi, Lehman, AIG, Merrill, etc.) whose cleanly-reported controls did not protect them from the fatal infection of the credit market collapse.

Third and most pernicious, there are the inevitable side effects.

It is mis-directed and erroneous to ask whether corporate behavior has improved since the post-Enron legislative spasm of 2002. Rather, Sarbox has never been fairly measured for its negatives – extravagant costs, severe disruption of the auditor-client dialog and relationship, and diminution of real value contributed by the assurance process. Just as most flu victims recover full good health, whether treated or not, the proper question is how the side effects of Sarbox weigh against the evolved corporate governance and controls that would have emerged in the normal cycle, had the law never been enacted at all.

Discussion of the Sarbox cost-benefit analysis typically omits recognition that the equivalent of “good health” practices was always in place. Just as preventive hand-washing and use of Kleenex will fend off most routine contagions, the prohibitions on false statements to investors under the American securities laws have a long tradition of deterrence – imperfect, to be sure, but nothing is. So the proper question is whether imposition of a universal requirement for additional measures under Sarbox could justifiably alter the prevention calculus for the better.

To conclude -- leave for another day, and soon, scrutiny of the potentially devastating litigation exposures run by small companies and their auditors when the next round of control failures show up in a renewed wave of investor litigation.

For now, compare with a health-delivery marketplace where individual choice still counts. Conscientious consumers can weigh the potential benefits of an experimental new vaccine. They can consider the risks of side effects and possible false comforts, absorb the publicity from a profit-driven drug industry, and decide accordingly.

With Sarbox 404(b), by contrast, unless a re-evaluation occurs while this latest deadline extension is pending, small listed companies will have no choice but to bend over and offer a fat and juicy target – to be stuck by a needle-wielding bureaucrat with the fear-inducing cry, “I’m from the SEC, and this shot is for your own good.”

Thanks for joining this dialog. Please share with friends and colleagues. And if not a subscriber, please join at the Main page – easy, free and non-commercial.