News

To SOX or not to SOX?

The question of benefits of introducing Sarbanes Oxley Act systems in organizations, the related costs and the impact on new Initial Public Offerings (IPO) has been raised again recently in an editorial in the Wall Street Journal. (Tuesday, November 27, Page 11, "Europe wins again".

The article uses a number of arguments to show that SOX is not effective and has a major detrimental effect on capital markets in the USA, in spite of the introduction of SOX guidelines for smaller entities by the PCAOB.

Cost is raised, with a figure of USD $ 3 million quoted as a basic expense to get newly listed companies to comply with SOX on listing. My personal experience is that these kinds of figures are grossly overstated, due to the oftentimes bad performance of project managers implementing SOX. The main issue continues to be the need for a thorough analysis of significant controls rather than to follow the urge to label everything a control without proper assessment as to materiality. If you consider that each control takes about 4 hours to test on average, and that such tests may have to be performed up to 4 times a year in the first year, in addition to tracking results of testing and remediation, it is obvious that such a strategy can lead to a cost blow out. The more contentious significant controls identified can also lead to arguments over their labeling between the SOX teams and managers responsible for those controls, aggravating the agony. SOX does not specify that all company financial reporting controls must be documented and tested, which is obvious as it would be impossible to classify each and every company in existence and account for each and every control in a regulatory fashion, so as to ensure they are all covered by reference to lists of regulated controls.

The pressure, as usual, comes from external auditors, who have suffered a great reduction in appetite for the level of risks they are willing to accept on assignments, and hence are more likely to err on the side of caution by including rather than excluding required controls. The management and handling of external auditors therefore also needs competence and experience, something not always available on the side of the companies being audited. It is clear that in many cases the auditors do not see the wood for the trees, and have difficulty grasping which ones should be in scope and which ones should not, with predictable impact on costs for the client company.

The article assumes that when investment banks pitch for new IPO work and include alternatives to the NYSE, the reason for doing so is the overwrought regulatory environment in the USA. I do not believe that the answer is so simple. Rather, companies would consider a number of factors in deciding where to list, including proximity or location of head quarters, or simply emotional ones.

The last statement, related to the impact on smaller investors who would not have access to numerous IPOs in their home market in the USA because the number of IPOs is dwindling is akin to suggesting that first time car buyers should indeed be given a choice to purchase a cheaper vehicle on their small budgets, cheaper because the vehicle is missing essential systems like brakes and does not have a road warranty of fitness. Would we propose such a system, allowing thousands of first time drivers to climb into unsafe and lethal machines at will to allow them greater access and choice?