View From a Height

Sarboxed In

Sarbanes-Oxley was passed in the wake of the corporate accounting scandals. Two of the bill's provisions have gained the most attention. One holds corporate officers personally responsible for the accuracy of the financial statements and annual report. The other requires that all of a company's internal processes be auditable.

Today, Holman Jenkins takes on the costs of these provisions, and their presumed benefits ("Thinking Outside the Sarbox", registration required):

Unprecedented and little appreciated is the extent to which the Big Four have been handed vast and sweeping new powers over companies and their managements.

Take the approaching deadline for many companies to implement the law's Section 404, whose 169 words require that an auditor attest to the adequacy of a company's internal controls over financial data. ... By and large, it's the accounting firms who decide, not only telling companies what they must do to meet the law's requirements, but frequently selling them the software and expertise to comply.

What's more, each of the Big Four is free pretty much to interpret Section 404 by its own whimsical lights, acting as judge and jury, with the accountants' dominant incentive being to protect their own posteriors with paperwork lest they be targeted in a shareholder lawsuit next time one of their clients goes bust.

...

Sarbox, rather, is the last gasp of a corporate governance kludge in which auditors became, in the public's eye, something they've never been in their own eyes: namely proof against fraud. In the audit industry's eyes (or at least in its behavior), the mandatory audit is a welcome gravy train that has gradually revealed an unwelcome Faustian caboose. Whenever a company blows itself up in an accounting scandal, the accountants pay for their gravy train by serving as an additional set of deep pockets for trial lawyers to sue.

Sarbox's "internal processes" bring to mind "insider trading." Oh, you think you know what insider trading is? Perhaps you'd like to send your suggestion to the SEC or to Eliot Spitzer, because in fact, there's no definition written into the law. George Mason's Henry Manne has made an academic career trying to show that there's no logical place to draw the line.

"Internal processes" suffer from more or less the same problem. For most companies, it means tracking not only dollars but product, all the way through the system. Good companies have always tracked this sort of thing. But what's different about Sarbox is the legal aspect.

Jenkins accurately notes the control that this give the Big Four accounting firms over internal accounting practices. But by implication, it gives them control over internal processes. There is no doubt that companies will begin, perhaps have already begun, to make business decisions based on the effects they'll have on their accounting. There's some evidence that this is already happening:

...The number of companies alerting the SEC that their latest financial reports will be late doubled last quarter, adding to a backlog of late filers that recently topped 600. One strategic-investor type who sits on the boards of a number of companies called a few weeks back to gripe in detail about what all this was costing the economy. Under the SOX regime, something as slight as an anonymous letter alleging accounting irregularities can effectively deliver a company entirely into the control of outside auditors. Directors, so fearful about their own liability that they stop thinking about what's good for the business and worry only about securing their own alibis, write a blank check with shareholders' money to do whatever the auditor dictates.

There's a secondary effect here, as well. The financial markets rely on timely information to make investment decisions. Sarbox, while doing little to improve that information, seems perfectly capable of delaying it. As the backlog increases, this will make it increasingly difficult for fundamental analysts to make informed judgments. It will place a higher premium on insider information, encourage rumor, increase market "surprises." Even technical analysts will have a harder time assuming that the market already has assimilated available information. In an era marked by stunning increases in market efficiency and responsiveness, Sarbox represents the first tangible step backwards in decades.

As much as this is costing big companies, consider the cost to small companies trying to gain access to the markets:

No wonder that the annual bill for Sarbox is going through the roof, with the latest estimates being about $6 billion for the Fortune 1000 alone. One investment banker estimates that a small company nowadays would have to generate $150,000 in free cash annually just to cover the additional paperwork before it can even consider going public. Then there's upwards of $100,000 each to insure all who sit on its board, if any can be found. Oh yes, and the fact that audit fees, for the average company, have risen about 50% in a single year.

Access to markets means access to capital. Access to capital is the means for competition, innovation, and for getting that innovation to the consumer. While large companies might be willing to pay for protection against new competition, it's hard to see why consumers, or even investors, would.

Sarbox is a bad law. It's vague, overly-intrusive, non-responsive, and will eventually subject even routine operational decisions to outside scrutiny of the most conservative and least dynamic kind. And it doesn't even fix the problems that inspired it.