The Sarbanes-Oxley Act (SOX), made law on July 30th 2002, was created "to protect investors by improving the accuracy and reliability of corporate disclosures made pursuant to the security laws". So far so good, but its complex and costly implementation and enormous amounts of required documentation have some companies groaning under its enforced weight.

An excellent panel came together at the Luxembourg Chamber of Commerce moderated by Louise Courtemanche, Sacred Heart University Director to discuss "Financial Integrity and its implications for European Multinational Corporations".

Dr. Eunsup (Daniel) Shim, Ph.D., Associate Professor of Accounting and Director of Research at Sacred Heart, spoke on the circumstances that led to the creation of the act which impacts all companies in the world listed on the U.S. stock exchanges. High profile acts of corporate malfeasance such as Enron and WorldCom and Tyco, and individuals such as Martha Stewart, destroyed investors' faith prompting millions of people to ask "Why did it happen'" The scale of the fraud (the N.Y. Times claimed that WorldCom pencilled in 1 billion dollars) set the business world reeling. SOX was created to enforce accountability and to uphold convictions for white collar crime. "Self regulation for the audit/accounting profession is a thing of the past."

The object of SOX, or specifically Section 404, is to eliminate fraud. Critics counter that there's a second effect to these activities: the "new rules help accounting firms double their payments".

A New Era

How much does it cost? Olivier Lemaire, Audit Partner at Ernst and Young, said, "A lot of money." Few would argue the necessity of stricter regulations in the industry. SOX is not just for corporate governance. It is to aid enforcement. It's the extent and expense that come up against criticism. External auditors must assess risk, report on control activities, and monitor information and communication. This creates a huge demand for documentation and therein lies the greatest expense of the exercise.

Michel Massart, Chairman of the Audit Committee of Millicom International Cellular did a presentation on his company's implementation rollout as a case example demonstrating just how complex this process can be. Luxembourg based Millicom has 18 cellular operators in 17 countries in Asia, Africa and Latin America. Some of the biggest obstacles they face in implementation arise from this decentralisation of their company. He acknowledged that "good internal control is no longer just best practice - it's the law" and clearly the company is making every effort to conform, but the costs are enormous.

They have to hire consultants for SOX 404 (it takes a few years just to initially conform), they have to consider the time the company spends on implementation, pay the audit fees and figure in the cost of making the company fully transparent. "The bar has been set at a much higher level than in the past," he noted. A company now has to prove everything they have been doing. An example was given of a major Swiss Bank that employed a team of 50 people just to work on SOX. Again, documentation was given as the single biggest expense.

As Dr. Eunsup said, "An era has ended and a new one is here to stay." All the panellists agreed that the companies in the U.S. that ran into trouble were the ones with control deficiencies and this is precisely what SOX is trying to prevent. But can the act ultimately prevent all fraud'

Olivier Lemaire doubted that fraud will ever be eliminated, saying "You cannot change what is in people's minds. Fraud is behavioural." Some analysts warn that such great amounts of data stored on corporate networks due to SOX requirements may be creating greater opportunities for fraud. "Bureaucratic monstrosity" or positive step towards greater transparency that will restore faith in the industry? The debate is far from over.