Sez Oxley: "Never Mind"
Radley Balko | March 8, 2007, 8:02am
One-half of the duo that created the most suffocating piece of anti-business legislation in recent history is backtracking:
Was Oxley aware, his questioners asked, that the law that he and Senator Paul Sarbanes, a Maryland Democrat, rushed onto the books five years ago after the collapse of Enron and WorldCom had contributed to a sharp decline in listings on U.S. stock exchanges? And, knowing what he knows now about the cost and effects of the law, would Oxley — who retired in January after 25 years in Congress — have done it any differently?
"Absolutely," Oxley answered. "Frankly, I would have written it differently, and he would have written it differently," he added, referring to Sarbanes. "But it was not normal times."
Good to know. So because of a code-3 case of the "do somethings," rashly-enacted, reactionary legislation is causing the U.S. to lose new listings to London and Hong Kong, corporations that are here face enormous compliance costs, stifled innovation, and a fear of risk, and all we get in consolation is Oxley's mea culpa at a rubber chicken dinner.
Reason symposium on SarBox here .
Kap | March 8, 2007, 11:01am | #
I'm an engineer that works at a mid-size oil-services company. Being a geek I typically do all of my engineering reports in HTML format, and I installed the Apache web server on my workstation so that my colleagues could browse my stress analysis results as a (company-private) intranet site.
It occurred to me that other folks here might like to do that, without the hassle of setting up their own web servers. I therefore made a little presentation for our IT guys (on my intranet website, natch) detailing how they could install Apache on the large file servers that serve everyone's network home directories, and here's how you could set up the Apache config file with aliasing, such that all you had to do was type in an engineer's user name in a web browser address bar, and you would automatically get their site, and all the engineer had to do to make the site was put stuff in an "HTML" directory at the root of his home folder. You could even make a little script to set everyone up automatically in a matter of seconds. I had visions of doing for my company what Tim Berners-Lee did for CERN when he invented the WWW.
The IT guys agreed that it would be very cool and useful, and easy for them to set up as well, but sorry, can't do it.
Why? Because our company was at the time trying to go public on NYSE, and the SOX regulations prohibited this sort of thing. You see, SOX doesn't just deal with legal and financial stuff. It also governs the entire
information flow within a business, with accounting of who has access to what and how any network permissions are set up,
even engineering information that has nothing whatsoever to do with money. They had just spent the past few months reconfiguring the entire network and filesharing system to put it in compliance with SOX, and they were damn sure not going to get themselves fired by getting involved with some damn fool intranet thing. And they were going to pretend that I didn't just tell them I installed Apache on my computer. And we didn't just have this entire conversation.
My company eventually bailed on the IPO and opted to be purchased by an already-public huge industrial conglomerate.
That experience floored me.
James Anderson Merritt | March 8, 2007, 1:05pm | #
JasonL | March 8, 2007, 8:59am | #
Unless you've seen this thing up close in your work life, I don't think you can appreciate how intrusive and horrible it is.
================================
mk | March 8, 2007, 9:08am | #
I haven't been touched by Sarb-Ox directly, but I did boggle at the clusterfuck that was HIPAA. More than anything, it seemed like a great opportunity for COTS software peddlers to demand that you buy new "HIPAA complaint" versions of their software for several thousand dollars.
================================
At one point, my company suffered from both Sarbanes-Oxley AND HIPAA. Because of "mandated" rotation of auditors and the different regimen the new guys brought with them, my company had to restate earnings over a long, torturous process. Eventually, the company sold out to a European transnational, which is not traded on the US exchanges, easing the Sarbox burden a bit. But HIPAA remains as a driving force and a huge burden in its own right. The primary result appears to be the demand for ever more detailed "audit" functions in our software, so that system administrators and government inspectors can, at random, check out practically any system activity, especially those that involve the manipulation or use of personal health info. Who accessed, when, from which terminal, using which software function, the information being accessed at the time, etc. If you're using this system, Big Brother is more and more over your shoulder, taking notes on everything you do. This is not because anyone at the customer site cares to accumulate this information to do their jobs, but rather because they think that HIPAA requires them do to so, and they are playing CYA.
Apart from causing all this audit-frenzy, and a corresponding mania for "security" features, HIPAA basically federalizes health information. The feds can get HIPAA-regulated entities to stand and deliver a lot more easily than in the past. So, in many ways, your PHI seems a lot LESS private and secure than it used to be, but much more available to the government. Which is, I think, one of the points of the legislation. Anyone who actually reads through HIPAA will recognize a good-sized chunk of the blueprint for federalization of the healthcare system. I see that process moving forward every day.
Dave W. | March 9, 2007, 9:14am | #
If I didn't actively participate in, or even know of, the wrongdoing that cause harm, why should I be held liable for it?
Because it turned out profitable, you are the one who would have profitted.
Look at it this way: if you made a contract, as an individual (or a general partnership of private individuals), to give an employee a pension, and you fell on hard times, then you would still have to pay the pension, even if personal sacrifice were involved. Declaring personal bankruptcy might (might!) reduce or eliminate this liability, but the personal bankruptcy would certainly involve you liquidating a lot of your property, all your "toys," all your bank accounts.
On the other hand if you contract with an employee to provide a pension with the corporation as employer, and the corporation falls on hard times, then you get to keep your toys and bank accounts. The corporation declares bankruptcy, but all the profits you pulled out of it over the years remain yours. Different result. Good for you. Bad for the people you contracted with.
Some things to note:
1. This example is a contract claim, not a tort claim. One of the commenters above was unduly focussing on torts.
2. Someone else suggested that individuals could set up structures similar to corporations, but not actually incorporate. they suggested that these "corporations" might just get the benefit of limited liability in the courts, despite the fact that they had not participated in the government's (state and federal) plan for how corporations are formed. This is not true. It is true that one could structure a business similar to a corporation, but just not incorporate. However, a court would call this a "partnership" and the commonlaw rules would apply. Those commonlaw rules (not likely to change now) are that there is not limited liability and you do not get the tax breaks your business would otherwise get. BTW, in an early reply on this thread, I suggested that businesses "opt out" of SarbOx. This is exactly the approach I was perjoratively daring the businesses to take. A bit later on the thd, I mused about how corporations were continuing to "get on the bus" despite the "rectal exam" that is SarbOx. Limited liability and favorable systemic tax structures are the "good stuff on the bus" that I alluded to.
3. Another poster, one of the ones unduly focussing on tort, wrote that in tort law liability is personal. That you have to do something personally negligent yourself to incur tort liability. Not true. If your migrant laborer negligently drops a brick on my head, then I sue you, not him. You may not have personally dropped the brick, but you were the one profitting by Jose's (sadly negligent) labors. Society therefore looks to you, to make me, the injured party whole. True, I can also sue Jose if I want (maybe he has winning lottery tickets), or you, the building owner can sue Jose for indemnification, but as between you and me, the rule is that I get to sue you. that has been the rule for a long, long time. it is a good rule.
