Oxley: I'm Not Happy with Sarbox

Michael Oxley has been guaranteed immortality — and perhaps a degree of infamy — since his name was affixed to the Sarbanes-Oxley Act of 2002, the most comprehensive set of corporate rule changes since the 1930s.

Earlier this year, Oxley retired from Congress after serving 25 years. However, the 63-year-old Republican from Ohio is not ready to fade from the scene. In the past month, he has picked up two new jobs: as counsel for the Cleveland-based law firm Baker Hostetler and as nonexecutive vice chairman of Nasdaq.

The act that bears his name missed unanimous passage through Congress by a mere three votes in the House of Representatives, and initially received grudging lip service from a shaken Corporate America. But a little-noticed section, just 168 words long, soon changed the debate from whether Sarbox was essential to restoring confidence in the U.S. capital market to whether it was destroying it. Section 404, which requires companies and their auditors to examine and report on the processes behind their financial reporting, quickly became the most expensive and hated provision of the act.

Today, Sarbox, and particularly 404, are under heavy attack, as are many of its accessory creations, most notably the Public Company Accounting Oversight Board. Both the president and many in Congress have said the act was poorly implemented, a criticism that neatly deflects the blame from those who made the law to those charged with implementing it. Technically, that's the Securities and Exchange Commission, although almost all of the critics leveling that charge are actually referring to the PCAOB.

In his final months in Congress, Oxley took to the hustings to defend the act, but more recently has joined the chorus of voices who say that the act, if not wrong itself, was poorly implemented.

Ironically, the loudest protests seem to be taking place after the largest companies have been through the worst of the compliance effort, but the result appears to be that small companies are likely to be spared the same degree of pain.

At Nasdaq, Oxley will serve as an adviser to Nasdaq president and CEO Bob Greifeld and the board of directors. In fact, he is about to join Greifeld on a listening tour to meet with CEOs and CFOs of listed companies and to discuss recent efforts at the SEC and PCAOB to tweak the rules of the law he wrote. He's likely to get an earful.

Oxley recently took time out to discuss the Sarbanes-Oxley Act and its many challenges with CFO.com contributing editor Stephen Taub.

Are you happy with the way Sarbanes-Oxley has been implemented?
Not really. The law has gotten a lot of criticism.

Why do you think this happened?
The main thing is the enormous cost that was driven by the outside audit. But, the auditors are under tremendous pressure too. Audits should be risk-based so companies can better assess the risks involved and move forward.

Why are the auditors under so much pressure?
It was Auditing Standard No. 2 [the standard for auditing internal controls over financial reporting], promulgated by the PCAOB, that started all the problems.

Why did it start with AS2?
Of the complaints you hear [about Sarbox], 99.9 percent are about 404. It was two paragraphs long, but by the time the PCAOB was done, it was 330 pages of regulations. It was far too prescriptive and [more] expensive than anyone anticipated. So, [the PCAOB] and the Securities and Exchange Commission proposed a risk-based assessment to better define material weakness, with more emphasis on internal audit. It adds flexibility with smaller companies. Those are common-sense proposals that I am confident will be adopted this year with a 5-0 vote, which would be a ringing endorsement of [SEC chairman Christopher] Cox's leadership and reaffirmation that the SEC and PCAOB want it to work in a more efficient manner. It will protect the investor and make regulations work to everyone's satisfaction.

You don't have a problem with backing away from AS2?
Now is the time to revise it and wring out costs. This is how the system works. We had the foresight to put in the kind of flexibility in [Sarbox] that allowed the SEC to defer smaller companies to comply. It is the same with foreign listings. This is a work in progress. It is not unusual to have regulators make changes in a broadly based statute. Some changes are necessary and good. This is the system, and it is working well. File off the rough edges and make it work for everyone. This will be one of those classic events.

In retrospect, if you had more time, would you have made different provisions for small companies?
Our committee's first hearing was December 2001. They signed the bill July 30, 2002. It was not rushed. When the House passed our version in April 2002, they did not have 404 in the bill. It was added in the Senate part after WorldCom. The answer is yes, in retrospect. If we had more time, we could have proposed a laddering of applications. That's hindsight. At the same time, the key was the flexibility it gave regulators.

• 1
• 2
• next »