Sarbox: three years in the making

It seems strangely fitting that in the same month as the Sarbanes-Oxley Act
celebrates its third anniversary, one of the men whose actions spawned this
monumental piece of legislation was jailed for 25 years.

Bernie Ebbers, the colourful chairman of WorldCom, will not be eligible for
release until he is 85 for his part in the $11bn (£6.2bn) fraud that cost
investors and shareholders $180bn and 20,000 people their jobs.

The debacle at WorldCom, one of the US stock market’s stars of the 1990s, and
the fraud at Enron, whose executives face trial in January next year, changed
the face of corporate America and the hasty legislation that followed,
Sarbanes-Oxley, will have a significant impact this side of the pond.

The Act, signed by President Bush on 30 July 2002, set out to boost public
confidence after two of the country’s largest and most well respected
corporations collapsed amid allegations of fraud. It was also supposed to cool
relationships between companies and their auditors, amid allegations that
WorldCom was so cosy with Arthur Andersen they used to regularly swap staff.

Sarbox, as it has affectionately come to be known, bought in a huge range of
new regulations governing audit committees and the creation of the Public
Company Accounting Oversight Board. It also spawned the infamous and unpopular
section 404, which will apply to UK companies with a US listing from July next
year.

The jury is still out on whether Sarbox has helped to restore consumer
confidence or improved US or UK plc practices, with firms across the pond just
completing year one.

What is clear is that complying with s404, where auditors rule on clients’
statements on internal controls, is costly, with research suggesting the one-off
cost to US Inc at around $5.5bn. But, conversely it has also stimulated the
market for auditors with a recruitment bonanza in both countries providing a
much needed boost for the financial services sector.

David Noon, Sarbanes-Oxley practice leader at Deloitte, says the impact on UK
companies has not been as significant yet because there is ‘already a mature
corporate governance regime’ in place. ‘It [s404] has put the focus back on
internal controls and there is a long journey to go,’ he adds, referring to
s404.

Noon says UK companies can learn from the experiences of their US
counterparts, and because guidance is constantly emerging he believes that the
benefits will eventually outweigh the cost.

Any significant changes to the Act have already been ruled out by one of its
architects, Michael Oxley, but the PCAOB has issued new guidance and conceded
that the first round of internal controls audits ‘cost too much’. Companies are
now tailoring their audit plans around specific risks instead of the ‘if it
moves, document it’ approach.

‘Most accept that Sarbox is here to stay and if they are sensible and get on
with it now instead of waiting till next year they can get back to business as
usual as soon as possible,’ says Noon.

So far at least, the Financial Reporting Council has ruled out any expansion
of s404 provisions to UK plcs without a US listing.

For those affected there will be few birthday bashes for Sarbanes-Oxley, but
when it comes to multi-billion dollar fraud, prevention is still better than
cure.