Is the Sarbanes-Oxley Act Working?

In response to the Enron bankruptcy and other accounting and corporate governance scandals (e.g., Tyco International, Adelphia), Congress began working on a corporate governance billthe Sarbanes-Oxley Act (SOX), which it rushed to pass after WorldCom filed for bankruptcy in July 2002. Prior to this, the bill's passage was far from certain; the House of Representatives and the Senate were in different stages of passing proposals that substantially differed and that faced significant opposition from lobbyists and trade groups representing accounting and business interests. But after the WorldCom scandal, "everyone in Washington wanted to do something-anything-to show they were cracking down on corporate fraud" (Joseph Nocera, "For All Its Costs, Sarbanes Law Is Working," New York Times, Dec. 3, 2005, p. 1).

And crack down they did: SOX has been described as the most sweeping federal legislation concerning corporate governance since the Securities Act of 1933 and the Securities Exchange Act of 1934. But given the law's hurried passage and broad scope, critics have charged that it has had unintended consequences and that its costs exceed its benefits. Now that CPAs have had a decade of experience with SOX, it is useful to review several metrics in order to determine whether the act's touted benefits have materialized.

Review of Objectives

SOX aimed to make financial reporting more transparent and to restore investor confidence in the U.S. financial markets. Specifically, its objectives included the following:

* Enhance auditor independence, primarily by restricting the nonaudit services that a CPA firm may provide to its audit clients and by requiring audit-partner rotation.

* Address concerns about the auditing profession's self-regulation by creating the PCAOB and charging it with regulating the profession and establishing standards.

* Improve corporate governance and, as a result, reduce (ideally, eliminate) fraudulent financial reporting. SOX approached this aim by requiring executives to certify financial reports and internal controls; providing for SEC rules that prohibit fraudulently influencing or misleading auditors; requiring attorneys to report evidence of fraud; requiring disclosures regarding the internal control structure and code of ethics for financial officers; and protecting whistleblowers, with significant penalties for noncompliance with SOX's various requirements.

Criticisms of SOX

The following sections discuss several criticisms of the act:

Scope. Some refer to SOX as the toughest piece of corporate governance legislation ever enacted; others argue that although it represented a step in the right direction, it did not go far enough because it rotates audit partners (not firms), prohibits CPAs from providing only certain nonaudit services to their audit clients, and did not add accounting standards setting to the PCAOB's charge.

Costs versus benefits. One frequent complaint about SOX concerns the law's costs compared to its benefits-especially the cost of complying with SOX section 404, which deals with internal controls. Based upon studies conducted shortly after SOX took effect, average section 404 compliance costs ranged from $4.36 million to $7.8 million, and large companies (those with more than $10 billion in revenue) reportedly spent more than $10 million each (Ken Small, Octavian Ionici, and Hong Zhu, "Economic Impact of SOX," Review of Business, vol. 27, no. 3, 2007, pp. 47-55).

Some believed that these costs will drop as companies become more familiar with the law and improve their control systems. But others found that, despite remaining at manageable levels for most organizations, SOX compliance costs did increase from 2011 to 2012; thus, not all the data support the contention that costs should steadily fall ("Building Value in Your SOX Compliance Program: Highlights from Protiviti's 2013 SOX Compliance Survey," http://www .protiviti.com/soxsurvey). Then again, Protiviti found that 75% of surveyed companies spend less than $1 million on SOX compliance, which is considerably lower than the amounts reported in the early studies on section 404 implementation.

Another investigation of costs examined stock price reactions to key SOX-related legislative events, based on the notion that stock returns over key event days should reflect the expected costs and the benefits of SOX (Ivy X. Zhang, "Economic Consequences of the Sarbanes-Oxley Act of 2002," Journal of Accounting and Economics, vol. 44, no. 1-2, 2007, pp. 74-115). Finding the U.S. market return around such events to be negative, Zhang suggested that, according to these results, SOX imposes significant net costs. Yet Christian Leuz noted in 2007 that such studies have methodological limitations, suggesting a need for care in attributing negative returns to SOX and in interpreting evidence on the costs of SOX ("Was the Sarbanes-Oxley Act of 2002 Really This Costly? A Discussion of Evidence from Event Returns and Going-Private Decisions," Journal of Accounting and Economics, vol. 44, no 1-2, 2007, pp. 146-165). He goes on to say:

My discussion raises questions about popular claims that SOX has been excessively costly to firms. But I hasten to add that it would not be surprising if one-size-fits-all regulation imposed significant net costs on firms. Moreover, it is possible that SOX set off incentives to overspend on internal controls because managers and directors bear only a small fraction of the compliance costs but share disproportionately in a liability from control deficiencies. ... Presently, however, we do not have much SOXrelated evidence to support the conclusion that SOX has been excessively costly. In fact, there is evidence that SOX has increased the scrutiny public firms face, as intended by Congress, and that this effect has produced certain benefits. But the net effects on firms or the U.S. economy remain unclear, (p. 163)

Despite such mixed evidence, both the SEC and PCAOB succumbed to political pressure in 2007 and responded to criticisms regarding section 404 compliance costs. The PCAOB replaced Auditing Standard (AS) 2, An Audit of Internal Control over Financial Reporting Performed in Conjunction with an Audit of Financial Statements, with AS 5, An Audit of Internal Control over Financial Reporting That Is Integrated with an Audit of Financial Statements, which relaxed standards for assessing and auditing internal control. The SEC issued guidance for management, which "sets forth an approach by which management can conduct a top-down, risk-based evaluation of internal control over financial reporting" ["Commission Guidance Regarding Management's Report on Internal Control over Financial Reporting under Section 13(a) or 15(d) of the Securities Exchange Act of 1934"].

In 2011, the SEC conducted a study to determine, in part, the effectiveness of the 2007 reforms with respect to issuers with a public float of $75 million to $250 million. It found that the 2007 reforms had the intended effect of reducing the compliance burden and improving the implementation of SOX section 404 for the group of issuers studied ["Study and Recommendations on Section 404(b) of the Sarbanes-Oxley Act of 2002 for Issuers with Public Float between $75 and $250 Million," SEC, 2011]. This SEC study recommended maintaining the existing investor protections of section 404(b) for companies with a market capitalization greater than $75 million and encouraged activities that have the potential to further improve both the effectiveness and efficiency of SOX section 404(b) implementation.

The Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 brought additional changes to SOX by exempting all public companies classified as nonaccelerated filers by the SEC-that is, companies with less than $75 million in public float-from complying with SOX section 404(b). (Note that these smaller issuers were never required by the SEC to comply with this section.) In the consideration of the bills that became the Dodd-Frank Act, several proposed amendments would have exempted an even larger number of public companies from SOX section 404(b), but these were not adopted. In addition, the Jumpstart Our Business Startups (JOBS) Act of 2012 exempted all companies defined within the act as emerging growth companies from complying with SOX section 404(b). An emerging growth company is defined as an issuer with total annual gross revenues (as presented under U.S. GAAP) of less than $1 billion during its most recently completed fiscal year.

Impact on cross-listing. Some financial professionals believe that SOX has had a chilling effect on international companies' cross-listing in U.S. markets (Hong Zhu and Ken Small, "Has Sarbanes-Oxley Led to a Chilling in the U.S. Cross-Listing Market?" The CPA Journal, March 2007, pp. 32-37). William Baldwin noted that the savings for a big firm that flees a U.S. exchange listing might run to $10 million a year and that such "refugees" also avoid the U.S. legal system ("These Stocks Sidestep Sarbanes-Oxley Idiocies," Forbes, Jan. 21, 2013, p. 1). Data from the Committee on Capital Markets Regulation show a marked decline in cross-listings in the U.S. by foreign companies after SOX's passage (http://capmktsreg.org/educationresearch/competitiveness-measures/ u-s-cross-listings-and-delistings-by-foreigncompanies/).

On the other hand, delistings by foreign companies from the New York Stock Exchange (NYSE) have been relatively constant since 2000, with the exception of a sharp spike in 2007. Thus, any effect of SOX on (potential) foreign registrants appears to discourage cross-listing, rather than to encourage delisting. Some argue that the U.S. public markets should lessen regulatory burdens in an attempt to regain their edge, but such notions might be counterproductive and could backfire over the long term. Given that investors value a stock market's ability to certify listed companies, lowering disclosure standards might harm an exchange's prestige and its ability to attract high-quality foreign companies.

Impact on small companies. Detractors of SOX have argued that compliance costs fall disproportionately on small firms. Indeed, some small companies are reportedly going private to avoid SOX's reporting requirements. To test this hypothesis, Ellen Engel, Rachel M. Hayes, and Xue Wang addressed the net costs imposed by SOX by analyzing firms' decisions to go private, based on the notion that companies will avoid the costs associated with SOX by going private whenever they outweigh its benefits, plus any net benefit from being public prior to SOX ("The SarbanesOxley Act and Firms' Going-Private Decisions," Journal of Accounting and Economics, vol. 44, no. 1-2, 2007, pp. 116-145). Engel, Hayes, and Wang provide evidence that suggests a higher incidence of going-private transactions following the passage of SOX and indicates that SOX was more costly for smaller and less liquid firms.

Impacts on auditors. Given that SOX resulted, in no small part, from a rash of high-profile audit failures and that many of its provisions significantly affected the public accounting profession, it is interesting that accountants are not among SOX's contemporary critics. The law enabled CPAs to return to what they were trained to do (i.e., auditing, as opposed to consulting); this has been a financial boon for CPA firms, due to the requirement that auditors audit a company's controls as well as its books.

A study of changes in auditor fees surrounding SOX found that they increased approximately 74% in the post-SOX era, which more than offset a decline in nonaudit fees over the same period (Aloke Ghosh and Robert Pawlewicz, "The Impact of Regulation on Auditor Fees: Evidence from the Sarbanes-Oxley Act," Auditing: A Journal of Practice and Theory, vol. 28, no. 2,2009, pp. 171-197). (CPA firms can still provide consulting services for nonaudit clients.) Higher fees reflect the heightened audit effort required by SOX and a greater potential exposure to legal liability. They were especially notable among Big Four auditors, whose audit fees increased 42% more than their smaller counterparts. The extra work brought on by SOX has also allowed auditors to shed unprofitable or riskier clients.

Another SOX provision created the PCAOB, which has garnered some auditor support; for example, Ernst & Young stated that the PCAOB has contributed significantly to audit quality and auditor independence and believes that opportunities to build on SOX's foundation should be pursued ("The Sarbanes-Oxley Act at 10: Enhancing the Reliability of Financial Reporting and Audit Quality," 2012). On the other hand, some executives surveyed in the wake of SOX felt that auditors, who worried about being second guessed by regulators and plaintiffs lawyers, were being too conservative and were requiring too much disclosure, as well as testing immaterial controls (Jonathan D. Glater, "Here It Comes: The Sarbanes-Oxley Backlash," New York Times, Apr. 17, 2005, p. 5). In this case, too, one can observe mixed reactions to various SOX provisions.

With most government regulation, it is not difficult to determine who is impacted and in which ways. Compliance costs might be estimable and the parties that bear them known, although that is more often the case with direct costs, as opposed to indirect costs. Given that regulation is usually intended to achieve objectives that benefit society as a whole, estimating the amount of these benefits is more difficult (and often impossible). Conducting a cost/benefit analysis often comes down to the proverbial question of whose ox is being gored-and it becomes a matter of judgment (often biased), rather than a simple economic analysis. As indicated in the various viewpoints above, SOX is certainly no exception to this general rule.

Possible Detriments Id SOX's Effectiveness

Short-term market pressures, greed (driven by excessive executive compensation), and cultural features might continue to influence executives to commit fraud. Ultimately, financial reporting fraud stems from a lack of ethical conduct by management, which SOX cannot correct. In other words, fraud is not so much due to poor controls as to executives who override controls when pressured to show earnings, forces that are not amenable to regulation.

SOX requires audit committees to establish procedures for receiving whistleblower complaints regarding accounting, auditing, and internal control irregularities and to provide for the confidential and anonymous treatment of employee concerns with respect to such matters. In "Don't Shoot the Messenger," Courtenay Thompson

A primary objective of SOX was to enhance auditor independence; however, potential impediments to meeting this goal remain. For example, auditors are still hired by their clients; thus, incentives-whether real or perceived-to "keep the client happy" remain. To counter any tendencies of auditors to get too cozy with management, SOX transferred the authority to appoint auditors from management to the audit committee. This represented a compromise between the status quo and more aggressive proposed solutions, such as mandatory audit firm rotation or a requirement that companies purchase financial statement insurance, with the insurance company hiring and paying the auditor. In 2013, the House of Representatives passed a bipartisan bill to amend SOX to prohibit the PCAOB from requiring mandatory audit firm rotation; the Senate did not take up the legislation, and the PCAOB announced in February 2014 that it would be shelving the rotation project.

Furthermore, SOX did not require that CPA firms cease all nonaudit services. For example, auditors still do tax work for audit clients, and independence can be questioned when a company defends an audit client on tax matters. Auditors might also advise their clients on internal controls, then assess those controls and report on their adequacy; this essentially places them in a position to approve their own woik. To avoid potential conflicts of this nature, Grant Thornton refuses to help audit clients with any aspect of control design or implementation, and some companies hire accounting firms other than their auditors for such work (Jonathan D. Glater, "Worry over a New Conflict for Accounting Firms," New York Times, Sept. 3,2003, p. 1). In addition, some concern has been expressed over auditors performing compensated consulting work for audit clients (which SOX still allows); thus, questions remain as to whether SOX has fully achieved its "auditor independence" objective.

Attempting to reduce fraud via regulation that increases the independence of outside monitors (e.g., mandatory partner or firm rotation) poses its own set of potential problems: more independence reduces access to information. Although new auditors might be more independent, they are not as knowledgeable about a firm and its management as ones with long-standing tenure; this puts them in a weaker position to counter a senior management team that succumbs to the pressure to improve results and engages in collusive financial reporting fraud. Ultimately, this fact remains: the efficacy of the financial reporting process is heavily dependent upon the integrity of all those involved, something that cannot be legislated.

Evidence for and against SOX's Effectiveness

The results of two studies that examined stock price reactions to legislative events surrounding SOX were consistent with investors' anticipation that SOX would enhance the quality of financial statement information by constraining earnings management, and thus restore investor confidence (Haiden Li, Morton Pincus, and Sonja Regó, "Market Reaction to Events Surrounding the Sarbanes-Oxley Act of 2002 and Earnings Management," working paper, 2006, http://papers.ssm.com/sol3/papers.cfm?abstract_id=475163; Pankaj K. Jain and Zabihollah Rezaee, "The Sarbanes-Oxley Act of 2002 and Security Market Behavior: Early Evidence," working paper, 2005, http:// papers.ssrn.com/sol3/papers.cfm? abstract_id=498083). These studies suggest that SOX created an environment that promotes strong marketplace integrity, and investors considered its enactment favorably. Jain and Rezaee also found that 1) more compliant firms with better corporate governance, reliable and transparent financial reports, and more credible audit functions prior to the act were affected more positively than other firms, and 2) SOX is wealth increasing, on average, and the market reaction is more positive for companies that were closer to compliance (measured by their corporate governance, financial reporting, and audit functions) prior to the act's enactment. Overall, these authors suggest that the induced benefits of SOX, as measured by stock prices, significantly outweigh its imposed compliance costs.

In 2005, Paul Sweeney interviewed a variety of stakeholders and interested parties, and he gave SOX a mixed report card with respect to whether it has made a demonstrable difference in the level of corporate fraud; however, he identified a general consensus that corporate governance improved following the passage of SOX ("Sarbanes-Oxley Report Card Is Mixed," Financial Executive, ol. 21, no. 10, pp. 22-25). Revisiting the matter of SOX's effectiveness in 2012, Sweeney found that many of those he spoke with believed that, although SOX did not do everything it set out to do, it has proved to be beneficial ("Sarbanes-Oxley A Decade Later," Financial Executive, vol. 28, no. 6, pp. 83-87).

If controls are improving, the profession should see a reduction in the number of audit reports that cite companies for material weaknesses in their internal controls. A material weakness exists when the design or operation of internal controls does not allow for the prevention or detection of a misstatement on a timely basis, and thus can result in a material misstatement. One study of 2,500 companies, conducted shortly after SOX took effect, reported an 8% rate of material weaknesses in controls; another review of 1,457 companies found a 5.6% rate (Glater 2005). In 2008, Kam C. Chan, Barbara Farrell, and Picheng Lee compared companies that reported internal control weaknesses with those that did not and found some evidence of earnings management for companies reporting material internal control weaknesses under SOX section 404 ("Earnings Management of Firms Reporting Material Internal Control Weaknesses under Section 404 of the Sarbanes-Oxley Act," Auditing: A Journal of Practice & Theory, vol. 27, no. 2, pp. 161-179). Companies receiving such reports have an incentive to improve their controls because the market tends to react negatively to them; thus, improved earnings quality might result as well. In Protiviti's aforementioned survey of 300 companies, 80% experienced at least a minimal improvement in internal controls over financial reporting since the SOX section 404(b) requirements took effect.

Restatements might indicate that nervous executives (or their auditors) are addressing financial reporting problems. Using data from a study of financial statement restatements by Glass Lewis & Co. that show a marked increase in restatements after the passage of SOX, Lynn E. Turner and Thomas R. Weirich concluded that SOX is causing the financial housecleaning necessary to restore investor confidence ("A Closer Look at Financial Statement Restatements: Analyzing the Reasons Behind the Trend," The CPA Journal, December 2006, pp. 12-23). A few years later (also using Glass Lewis & Co. data), Tammy Whitehouse noted a steep drop in restatements from 2007 to 2009 (for companies with market capitalization of at least $250 million, 344 restated in 2007, 172 in 2008, and 75 in 2009), but observed that it is impossible to tell whether this indicates that companies are producing cleaner financial statements or just not finding or reporting mistakes. This drop may also have been induced by the more relaxed standards for auditing and assessing internal controls promulgated in 2007.

To put these improvements in context, Glass Lewis & Co. noted that the rate of companies receiving adverse internal control opinions stood at 2% in 2010, down from 14% the first year that SOX required them; it further reported that most of the recent errors resulted from basic misapplication of GAAP (cash-flow and balancesheet misclassifications, underreported compensation expenses from backdated stock options, and lease accounting errors are leading causes of misstatements), poor systems, or unskilled or lacking personnel-not from manipulative accounting practices (Stephen Taub, "Surge in Restatements, Material Weaknesses," CFOZone.com, Nov. 22, 2010).

New analysis. In addition to the studies outlined above, this article's authors conducted their own analysis in order to determine the possible effectiveness of SOX. If fraud at companies has decreased, reduced media coverage reporting on financial fraud should also be observed. The authors surveyed two large newspapers (the Washington Post and New York Times) from 1997 to 2012, using a variety of fraud-related keywords (e.g., accounting catastrophe, accounting disaster, accounting fraud, accounting games, accounting governance, accounting irregularities, accounting misconduct, accounting misrepresentation, accounting shenanigans, corporate governance, financial fraud, and financial shenanigans). Exhibit 1 contains the graphic summary of the findings.

Predictably, the number of newspaper reports referencing the search terms peaks in 2002, with 1,267 matches-an increase of almost 360% over 2001. News reports in 2003 remained robust, with 1,068 (a decline of just under 16%). The media hits captured by this survey have steadily declined since 2005, with only 355 reports in 2008 (a 72% decline from the 2002 peak). This evidence might indicate a decline in the amount of actual fraud, but it could also represent shifting media interest; SOX caused reporters to focus on accounting and financial statement fraud, creating a du jour effect that has subsided as the memories of Enron and WorldCom have faded. In support of this theory of shifting media interest, matches to the fraud terms have started to increase again after bottoming out in 2010; this timing coincides with the financial crisis in the mortgage and banking industry that began in 2007, which drew attention away from financial statement fraud. As the financial crisis has subsided, it appears that media interest is beginning to again refocus on fraud-related topics.

The authors further analyzed the data in order to interpret the recent uptick in media interest and found that a large portion of the increase is related to articles containing the keywords "corporate governance." A simple search of articles related to this keyword indicated that "activist investor," "shareholder activist," and "activism" are important topics gaining widespread media coverage. Although corporate governance is an important topic that SOX attempted to improve, an increase in activism-related media reports may not reflect a changing incidence of fraud.

If fraud has decreased, the authors would also expect the number of SEC Accounting and Audit Enforcement Releases (AAER) to decrease. The SEC issues AAERs in fraud cases that involve an accountant; they are often used in accounting research as a proxy for financial statement fraud. The authors collected the number of AAERs issued each year from the SEC's website (http://www. sec.gov/divisions/enforce/friactions.shtml). Exhibit 2 displays the results, indicating a peak in AAERs in close proximity to the passage of SOX. AAERs remained at elevated levels through 2007, after which they gradually declined. Again, although this decline might indicate a reduction in fraud at publicly traded companies, it is more likely the result of a shift in focus by the SEC.

The financial crisis of the late 2000s compelled the SEC to redirect its efforts to regulating the financial services industry. As Jean Eaglesham stated:

During the financial crisis, SEC enforcement officials devoted much of their energy to reining in alleged crisis-related malfeasance, such as misleading investors about the risks of subprime loans or mortgage bonds ("Accounting Fraud Targeted: With Crisis-Related Enforcement Ebbing, SEC Is Turning Back to Main Street," Wall Street Journal, May 28, 2013, p. Cl).

But Eaglesham also suggested:

The falloff in accounting-fraud crackdowns by the SEC also may reflect improved financial reporting by companies because of Sarbanes-Oxley mies that took effect in 2002 after the Enron Corp. and WorldCom Inc. scandals.

Eaglesham indicated that SEC chairman Mary Jo White plans to refocus the agency's efforts on accounting fraud; this suggests that the SEC believes that financial statement fraud has not significantly declined or been eliminated as a result of SOX.

Mixed Results and Further Study

Based upon this review, the evidence on SOX's effectiveness is mixed. The initial cost estimates might have been overblown, with the cost of compliance stabilizing at manageable levels; however, concerns about the high cost of compliance for small companies might ring hue, with more of them opting to refrain from listing or going private in order to avoid compliance costs. Furthermore, foreign businesses might not be accessing U.S. capital markets due to increased compliance costs and litigation risk resulting from SOX. Audit firms have benefited from the law because it has created new revenue from controlrelated compliance work. Evidence indicates that SOX might have improved financial reporting quality, although it might not have deterred actual fraudulent behavior. Corporate governance provisions of the act also appear to have improved overall board composition and engagement. The act also apparently caused an immediate increase in restatement activity, but little has been offered to explain the increase.

Although the authors' data implies that the incidence of fraud has decreased since SOX was enacted, a definitive statement to that effect cannot be made because the data might be the result of fluctuating media and SEC attention as the 2007-2008 financial crisis shifted focus away from financial reporting and fraud. Based on SEC Chairman Mary Jo White's comments regarding renewed emphasis on financial reporting, the authors expect to see renewed media interest and accompanying increases in AAERs and restatements.

As accounting professor Paul M. Clikeman stated, "Many ... scandals led to significant improvements in auditing procedures and financial reporting practices" {Called to Account: Fourteen Financial Frauds That Shaped the American Accounting Profession, Routledge, 2009). Although the overall impact of SOX might be impossible to measure, the research discussed above suggests that it might have improved financial reporting practices. The question of whether this has been enough to justify its costs will probably never be answered. The authors hope that future research will continue examining this important legislative reform and its impact on the accounting profession. ?

Despite mixed evidence, both the SEC and PCAOB succumbed to political pressure in 2007 and responded to criticisms regarding section 404.

A primary objective of SOX was to enhance auditor independence; however, potential impediments to meeting this goal remain.

Evidence indicates that SOX might have improved financial reporting quality, although it might not have deterred actual fraudulent behavior.

Stephen D. Willits, PhD, CPA, is an associate professor of accounting, and Curtis Nicholls, PhD, is an assistant professor of accounting, both at Bucknell University, Lewisburg, Pa.