The only thing corporate America and its auditors could possibly be spending more time on these days than complying with Section 404 of Sarbanes-Oxley is lamenting it.
The time spent contemplating reports, studies and analyses of the cost - both in dollars and time - related to what has arguably become the most-discussed section of the sweeping 2002 reform law rivals, if not exceeds, the amount of press attention given to the selection of the new Pope.
Of course, it's for good reason. Thought it is a relatively small section of the legislation, it has become a major headache for corporate executives and their auditors by way of taking up far more time and resources - financial and otherwise - than anyone estimated. Ask any member of the profession who is currently engaged in 404 compliance work, and they will tell you that, while it is for most, the fastest growing portion of their business, it is also their worst nightmare.
I think almost anyone would agree - including regulators, who have publicly admitted as much - that implementing 404 is costly and time-consuming. So it's not really surprising that cries to roll back that portion of the law have ensued.
A few weeks ago, Texas Congressman Ron Paul introduced legislation to repeal the provisions of 404. In a press release announcing the legislation -- in which he blames SOX for, among other things, favoring large companies over small competitors, retarding economic growth and trampling due process rights -- Paul says, "Now that the Enron and Worldcom hysteria is over, it's time to admit that Congress made a terrible mistake."
I wonder if Congressman Paul's fellow Texans who were personally affected by the Enron fiasco would agree. As evidenced by the number of corporate accounting scandals that have since surfaced, the fact remains that Enron and WorldCom were just a trickle in the gush of scandals that Sarbanes-Oxley was intended to slow.
Of course, I'm not saying that the law as crafted is perfect. Or that it doesn't need to be revisited to ensure that it does what it was intended to do. Such a review is in order, and regulators, at least, appear willing to take into consideration the gripes related to 404. The Securities and Exchange Commission recently hosted a roundtable that gave businesses and auditors a chance to vent their frustration with it.
But seeing that the companies and the auditors who must adhere to it have barely had time to digest 404 -- many internal auditors are just now experiencing their first full year of helping their organizations comply with Section 404, and the SEC recently granted a one-year extension on 404 compliance for small companies and foreign issuers that trade in the U.S. -- it seems to me that calling for the section's repeal is more than a little premature.
And as big as the 404 price tag may be, how big is it when you compare it to the cost of the accounting scandals - and loss of investor confidence -- we've already witnessed? As much as some companies will spend to comply with 404, I'm sure many of them will spend far less than "Kenny Boy" and his friends lined their pockets with at the expense of investors.
In any case, wouldn't it make more sense to assess the impact of 404 after everyone who has to comply with the rules has actually implemented them? Corporate America didn't end up in this mess overnight. We can't expect it to be fixed overnight, either. Pulling the plug on 404 now won't do much to improve things.
