You Can Be Too Careful

How the government's new corporate accounting rules impede efficiency and stifle innovation.

Adelphia founder John Rigas got 15 years (a life sentence for the 80-year-old executive), and former WorldCom CEO Bernard Ebbers got 25–two victories in the government's post-Enron wave of corporate fraud prosecutions. Meanwhile, the Enron case itself has crawled along, with few significant victories and a handful of defeats for federal prosecutors. The trials of former Enron chairman Kenneth Lay, president Jeffrey Skilling, and chief accounting officer Richard Causey are set to begin in January.

New laws were not necessary to prosecute those executives. Still, Congress responded to the scandals that destroyed or hobbled their companies by passing the Sarbanes-Oxley Act. Signed into law by President George W. Bush on July 30, 2002, Sarbanes-Oxley was supposed to crack down on accounting irregularities, punish those responsible for hiding them from the public, and curtail potential conflicts of interest in corporations' relationships with their auditors. HealthSouth CEO Richard Scrushy was the law's first big collar. He recently walked away from his trial a free, if disgraced, corporate bigwig, after 21 days of jury deliberation. Many credit Scrushy's refusal to testify in his own trial as a plus for him–he left the jury to judge the probity of a bunch of other HealthSouth execs, self-confessed fraudsters who had previously pled guilty and testified against Scrushy.

Sarbanes-Oxley, a.k.a. SarbOx, is a complicated law that has the business world abuzz with annoyance and anxiety. Among other things, it requires that CEOs and chief financial officers certify, under penalty of 20 years in prison and $5 million in fines, that their internal financial controls are in order and that they lead to accurate reports. It says executives must provide "reasonable assurance" that everything is kosher, a provision that is likely to invite litigation as well as prosecution. The law created the Public Company Accounting Oversight Board, adding yet another level of oversight to a profession already monitored by the Securities and Exchange Commission, the Fair Accounting Standards Board, and the Justice Department. The board is ostensibly private, but has the power to force accounting firms to pay both fees for its operations, and fines for disobeying its edicts. SarbOx also requires that auditors (though not necessarily auditing firms) switch out every five years, and it prohibits auditors from jumping ship to executive positions at companies they have just audited.

Critics in academia and business journalism–and many from the corporate world itself, most of whom are reluctant to talk on the record and thereby show "bad faith" regarding the law–have many complaints about SarbOx, from its picayune requirements to its overall cost. While all such guesstimates should be taken with a grain of salt, one financial consulting firm, the Johnsson Group, has put the 2004 costs of SarbOx compliance at $15 billion. The critics also argue that the law's benefits are apt to be small.

America did indeed suffer a wave of corporate scandals that ended in the loss of hundreds of billions of dollars in market value. And the scandals did involve accounting fraud, part of a desperate attempt to cover up the companies' grim realities. But the underlying problem was not crooked accounting; it was bad business practices. A reform aimed mostly at accounting is not likely to solve the problem of stocks that lose value because the people running the company have bad strategies and make stupid decisions and are losing money. In fact, better accounting will speed up the collapse in market value.

Nor is it clear that CEO-certified financial information, SarbOx's main gift to the average investor, will make a noticeable difference. A study by the University of Indiana finance professor Utpal Bhattacharya and some of his colleagues, reported by them in the Fall 2003 issue of Regulation magazine, found that public certification of financial statements by CEOs had no apparent effect on stock prices. That doesn't mean the market doesn't care about accurate financial information; it merely means the market has ways of figuring these things out without legally mandated certification.

SarbOx probably won't cripple the American economy, any more than the Clean Air Act or the Americans with Disabilities Act did. But it's bound to create bad incentives and unintended consequences. Far from increasing the efficiency of capital markets, it will discourage some businesses from going public, since most of its provisions do not apply to privately held companies; will encourage some now-public companies to go private; and will keep some foreign companies out of the U.S. stock market.

According to a survey of companies with under $1 billion in annual revenue done by national law firm Foley and Lardner, SarbOx has more than tripled the average annual regulatory costs of being a public company in the U.S., from around $1 million pre-SarbOx to $3.4 million in 2004. The law also may tend to chill mergers, since purchasing companies will now be legally responsible for the financial records and statements of their targets, documents they had no role in creating.

The costs of SarbOx compliance, while not driving anyone out of business, will siphon revenues toward legal and accounting work. That drain may, in the words of Forbes' Rich Karlgaard, "succeed in stopping the next Enron, but…crib-kill the next Cisco, Microsoft and Starbucks" by leaving them less capital with which to expand.

To get a better sense of how Sarbanes-Oxley is affecting American businesses, Reason Senior Editor Brian Doherty asked four people familiar with the law's consequences to explain what the new rules mean in practice.

Bob Merritt has 23 years of experience as a chief financial officer for restaurant chains, including Outback Steakhouse. He finally left the business in April 2005, partly out of frustration with the way Sarbanes-Oxley and its enforcement changed the nature of his work.

Karen De Coster is a certified public accountant who has done accounting work for a variety of public and private companies for seven years, and is now working in corporate finance for a Fortune 500 company in the auto industry. Although her politics tend toward radical libertarianism, she sees some benefit to "some of what is being done in the name of SarbOx compliance," along with a lot of burdensome requirements that make little sense.

As a Sarbanes-Oxley compliance consultant, Stephen Stanton is a man whose self-interest should encourage him to praise the law. But he sees little good coming from it, aside from added income for consultants and auditors.

Charles Wilson is chairman of the board of Trio-Tech International, a California-based semiconductor testing company with about 500 employees and a market capitalization of $12 million. Wilson, whose company went public in 1981, says Sarbanes-Oxley makes him wish he could reverse that decision.

Responses should be sent to [e-mail]

Reason: How has Sarbanes-Oxley affected the day-to-day work of people who deal with corporate finance?

Bob Merritt: Section 404 deals with internal controls. That's the part of the law everyone is objecting to most. It says management must certify they have reasonable, cost-effective internal controls to ensure there's no misstatement. The Public Company Accounting Oversight Board has generated rules that require you to certify and test petty cash control–the whole "cost-effective" component gets thrown out. So auditors or people implementing the 404 requirements are requiring lots of duplication of effort.

Here's one great example: If you use an Excel spreadsheet to prepare some numbers for financial statements, auditors want you to prove that you have internal controls in place to guarantee that the Excel spreadsheet adds up. You have to give the spreadsheet numbers to someone and have them manually add them up.

It's hard to explain the frustration, because it's relentless. Every week they come out with new requirements and new regulations, and your day-to-day work becomes more absurd and mired in minutiae. SarbOx isn't the only reason I left Outback–there were a lot of things that happened, and I was at a point in my career where it made sense. But my life at Outback had become just dealing day to day with regulatory matters. I'm a business developer by mentality; I've always been a business person with a financial background. And suddenly I became a cop and a compliance guy. That's not my nature. I want to build things, make things better, and I no longer had time to do that.

I got so frustrated, it wasn't worth coming to work. I'd rather be the guy that holds the pole that the surveyor looks down than be CFO of a public company.

Karen De Coster: As a corporate finance person, this massive body of rules and regulations touches every aspect of my job, including that which seems irrelevant to the big picture, and barely stops short of making me keep Excel spreadsheets of my daily toilet paper use at the office and having the CFO sign off on the roll. Corporate finance people recognize that much of SarbOx is exactly what we strive to eliminate from our work day: non-value-added processes that encumber employees from doing more useful work aimed toward analyzing and maximizing financial position and providing management and shareholders with meaningful data.

Much of this value-added work all but gets lost in the rush to comply with mountains of SarbOx bureaucracy. SarbOx has caused top-end managers and corporate financial people to abandon value-added analysis and process improvement for the sake of day-to-day compliance. The network of planning and tasking involved in compliance with SarbOx is a monster to behold.

Stephen Stanton: Section 404 of Sarbanes-Oxley requires companies to document their internal controls over financial reporting. In layman's terms, they have to make sure the numbers they report are accurate and complete, that everything reported really exists, that all transactions really occurred, and that there is no fraud or material misstatement. They also have to prove how they know there was no fraud or material misstatements and that the reports are accurate and complete.

It's like when you take a test in high school. It's not just about getting the right answer, which is what the traditional financial statement was–the auditor makes sure that the final answers are right. This is more like a math test where you don't get credit if you don't show your work. Even if the numbers are right, if you don't show how you got there, you fail under Sarbanes-Oxley.

Almost all companies have gotten clean auditors' opinions for years, decades, only to discover now they have half a million dollars' worth of work ahead of them to get a clean opinion. Another frustration is that what they traditionally relied on to get to right numbers, there's no evidence that took place. If they have a conference call meeting, it's not enough; now we have to create a paper trail for everything they do. Companies that switched to a paperless system are now buying a heck of a lot of paper.

If you don't create a paper trail, it doesn't count. It's like trying to prove you love your wife: How many flowers did you buy her? What did you get her for Christmas? Lots of little things you wouldn't normally have a receipt for. Every journal entry must be printed out on paper, get two signatures, including either the assistant controller or controller, and be put in binders. Every month they produce stacks of binders that have to be archived. To my knowledge, my clients doing that haven't discovered anything materially misstated.

Reason: What are the costs of complying with Sarbanes-Oxley?

Merritt: We had to have a 4 percent increase in bodies, and incremental costs in year one of 404 certification were $3 to $4 million. But [Outback is] a simple company, not an international conglomerate. And that doesn't count the hidden cost of management time spent on regulatory stuff and not being spent on business development.

De Coster: I don't put a lot of stock in collective statistics. The monetary costs, business by business, have been heavily circulated, even by the mainstream media. Millions here, millions there. Since the costs will be forever ongoing, you can run the numbers any way
you want, and you'll come up with a heck of a lot of zeroes.

However, the bigger cost is in terms of the centralization of a regulatory system that can effectively stifle the free market via the imposition of arbitrary decree. When management makes a decision to implement controls, it's because they see a future benefit accruing to the company. When a bunch of empowered elites in Washington, D.C., implement controls, it's for the purposes of a power grab, face-time in the limelight, and the furtherance of total, central control. SarbOx, in a sense, is a form of central planning wherein D.C. can effectively rein in Wall Street and have complete control over corporate policing.

Stanton: Sarbanes-Oxley compliance fees between my firm and accounting firms can range anywhere from 1 percent of revenues to 3 percent of revenues, or 50 percent of profits. Sarbanes-Oxley could cut off 3 to 4 percent of market capitalization, no problem.

Companies that have been working perfectly fine for years must hire additional people just to segregate duties more clearly. People like me go into companies, and we charge anywhere from a quarter million to a few million per engagement–not just me but firms I'm affiliated with–and we don't produce anything. We don't advertise anything; we don't book any journal entries; we are not a part of the business process. We are an add-on strictly there to produce a few documents.

One thing that defies common sense is that the law requires controls to be documented, so anytime you change your process you have to go back in time to readjust your reporting. Anytime you change the way you do business, install new software, start a new line of business, you need those changes documented. So all of a sudden change is the enemy; creative destruction is a bad thing. We actively encourage clients: Don't change your system; don't upgrade anything; don't change anything for the last three months of the year.

So it really stifles innovation, stifles growth. Some of our clients are systems developers, software sellers, and Sarbanes-Oxley hurt their business, because no company wanted to change [how they do things]; they've already spent time, money, and effort to document their controls as is.

It gives businesses a bigger predisposition to choose inaction over action. There's less intelligent risk taking, a bigger plus for being static and communicating less, because one of Sarbanes-Oxley's requirements is that any document you rely on, whether electronic or paper, to get to the numbers on financial statements, you must preserve, archive it so you can produce it in event of investigation. That is a very sweeping and vague requirement, meaning if someone sends an e-mail saying, "This client said they might not pay, but I'm not sure if it's just a joke," it needs to be preserved. Now they don't want to put anything in writing anymore.

Charles Wilson: Four major public companies are currently dominating the accounting field. As a result, fees continued to go up, and smaller companies like us had to go to second-tier accounting firms to stay in the business. But even second-tier firms, because of fear of liability, have become very expensive for small public companies. I'm involved in two other private companies and have been for years, so I'm quite aware of what accounting fees normally cost for private companies compared to a public one of our size, and the costs are four times higher–and that was before SarbOx came into being.

Now our accounting firms no longer can give suggestions on how to help you do better work, because they want to stay independent, and for them to remain independent they can't tell you what to do. They can only tell you you are doing it wrong. So now you have to pay two sets of independent groups, one checking internal operations to see they all are correct and another ensuring that you are doing them the most proper way.

The other problem with small companies is what you call materiality. What's considered material to a $25 million company vs. a company doing $1 billion in business is vastly different. So a small company has to pay auditors to go over every tiny item. $10 items have to be gone over carefully, whereas for a large company $1,000 can be overlooked. So that causes more money to be spent on accounting.

We will not make any money this year by the time we pay our accounting fees. Compliance has been delayed until July 2007 for smaller companies, but we have already started setting up the new systems.

And it's not just accounting fees. It's legal fees. The lawyers want to make sure you're complying with SarbOx, so you have them checking everything too.

Reason: Are there any benefits to Sarbanes-Oxley?

Merritt: Most of the law's requirements won't help investors and won't stop Enrons and WorldComs. I don't know how regulators will look investors in the eye next time there's a big blowup.

De Coster: The hardest thing for me to admit, from a libertarian yet practical corporate finance viewpoint, is that some of what is being done in the name of SarbOx compliance is very much needed within the corporate environment. The beneficial elements of SarbOx's requirements should have already been put in place by company management. Internal controls within many Fortune 500 companies were in disarray.

According to Compliance Week, which monitors the reporting of internal control weaknesses, March 2005 had 116 companies disclosing material weaknesses in their internal control over financial reporting, up from 28 for the same period in 2004. This is because '05 was the first year that companies had to provide internal control assessments as per Section 404 of SarbOx.

So is there value in SarbOx for stockholders? Yes, there is. But the fact that government usurped private processes in reaction to a host of big business failures sets the stage for a huge regulatory era in which businesses may no longer be able to operate outside of the realm of strict oversight and congressional decree.

Should the private accounting bodies have cleaned up their act prior to the domino effect of business failures? Indeed. The profession has not done a good job of changing the way it does things. It has allowed the old system to stagnate, instead of rolling with the times. The current financial environment of short-term finagling, tax avoidance, and revenue boosting for the sake of pleasing the latest Wall Street analyst of the day has skewed the way the accounting profession does things. You can thank government's abysmal tax policies and Fed-created credit bubbles for crafting most of those problems. Artificially inspired booms, courtesy of the Fed and monetary policy, will likely lead to corporate malfeasance.

Stanton: The only benefit this law can have is reducing the number of restatements. And the number of financial restatements in any give year is maybe 1 percent, maybe 2 in a bad year, and those don't take a company worth billions and turn it into one worth nothing. It's more likely to take a 10 percent hit, so maybe 1 percent of your portfolio takes a 10 percent hit in a given year due to financial restatements in a pre-Sarbanes-Oxley world.

Most business failures have nothing to do with accounting, stated financials, or fraud. Most business failures have to do with having wrong strategy, inefficient operations, poor marketing. Sarbanes-Oxley only puts CEOs on line for accounting risk, mistakes in financials. And that will shift their focus away from the 80 percent of problems businesses are likely to face to concentrate on 20 percent of the problems, because now that's what they'd go to jail for or be fined for.

Wilson: The day Sarbanes-Oxley passed was a great day for the accountants. It was an Auditors Relief Act. Now if you could afford to have everything double-checked like this, it would be terrific: Prove you are clean as a whistle and, God forbid, if you have some problem within the company, this really shows it up much sooner. But most companies can't stay in business if they do have problems anyway, and it's a very expensive way to keep everyone on the up and up.

If you had a problem, say, in a subsidiary, in terms of knowing whether or not it's really making money or if one of your executives is faking some of the information–which happens in small companies that aren't closely monitoring their people–in the long run the new system will pick up fraud and poor performance, and the company will become more efficient. But the question is costs balanced with benefits. I couldn't run stats on it, but I do know the costs of being public today are prohibitive. We would never go public in this market, and if we could afford to buy back the stock we'd go private.

SarbOx requires us to be much more careful, but we were doing that anyway. For those who don't want to do careful accounting it might be a good idea, but there are much more efficient ways to do it. The double layer of accounting oversight is unnecessary.

reason: Will criminal liability for CEOs and CFOs whose companies' financial statements are deemed inadequate be an effective deterrent to fraud?

De Coster: SarbOx can turn a CFO into a criminal overnight. So, yes, SarbOx requirements can make officers more fastidious in regard to thefinancial information going out the door. On the other hand, the officers with the sign-off responsibilities are not in the trenches, do not know the details, and quite often do not have any ideaabout what they are signing off on. The division of labor is such that they have to trust their employees to do the best job possible, and, the financials themselves aside, they often end up signing off on stuff when they don't even have the time to glance at it. It would be unrealistic to say that they could or should spend their time absorbing such details.

Stanton: No matter how much work we do, we can't prevent fraud or collusion. We ensure segregation of duties, make sure it would take two or more people acting in concert to slip something by. But it's real easy to make a friend and find someone to commit fraud with if you're hell-bent on doing it. Having CFO certification creates a laddering effect: He relies on the controller, who relies on departmental managers, who rely on accounting staff, and they all have to watchdog on each other and create a finger-pointing environment. In that sense you can get some degree of assurance, but you can't eliminate fraud.

Reason: How have your colleagues reacted to Sarbanes-Oxley?

De Coster: The public accounting and professional servicesfirms are ecstatic over the growth potential provided by SarbOx. The accounting firm KPMGreported that respondents to a survey overwhelmingly replied that the SarbOx Act has "boosted investor confidence in corporate America," whatever the heck that is supposed to mean. The American Institute of Certified Public Accountants brags that Section 404 "opens new doors" to consulting opportunities. My profession has always supported regulation, since it enhances revenues and growth opportunities.

Recall thatthe average accountant sees government regulation and oversight as a part of daily life, a necessity for everyday business maintenance and survival. They tend toward thinking that the absence of ironclad regulations would be akin to chaotic anarchy. Theprevailing commentin regard tothe SarbOxenvironment is, "It's been good for us, making us do things that should have been done before." Laissez-faire isn't exactly rampant among my colleagues.

But the SarbOx snare has produced some serious skepticism in the corporate world. When the effects of unchecked statism come home to roost, those most affected by it firsthand eventually rise up in resistance to the lunacy of it all. The average accountant or corporate finance individual has seen the light in regard to the sheer folly of it all, from having endured microscopic attention to even the most insignificant tasks. The more ridiculous the compliance procedures get, the more the average workertends to blow it off as frivolous.

Wilson: SarbOx is definitely discouraging smaller companies from going public, and it discourages good opportunities for investing in little companies. I have friends running private companies who say going public now would be just impossible.

Merritt: I can't tell you a single public-company CFO I know who hasn't wanted to leave in the last year, but maybe they're not in the financial position or age bracket to do that. We're not in business anymore. We're just in compliance.?