Sarbanes-Oxley Act Joshua Harold Ryan Stoeckel Wayne Tse

What is Sarbanes-Oxley ? Drafted by Sen. Paul Sarbanes and Rep. Michael Oxley Drafted by Sen. Paul Sarbanes and Rep. Michael Oxley Signed into law 7/30/02 Signed into law 7/30/02 A reaction to high-profile corporate fraud cases A reaction to high-profile corporate fraud cases Enron Enron WorldCom WorldCom Intended to prevent similar situations by Intended to prevent similar situations by Creating and strengthening corporate controls Creating and strengthening corporate controls Requiring enhanced financial disclosures Requiring enhanced financial disclosures Creating new standards for corporate accountability Creating new standards for corporate accountability Creating new penalties for acts of wrongdoing Creating new penalties for acts of wrongdoing

The Objective “To protect investors by improving the accuracy and reliability of corporate disclosures made pursuant to the securities laws.” “To protect investors by improving the accuracy and reliability of corporate disclosures made pursuant to the securities laws.” “To deter and punish corporate and accounting fraud and corruption, ensure justice for wrongdoers, and protect the interests of workers and shareholders.” “To deter and punish corporate and accounting fraud and corruption, ensure justice for wrongdoers, and protect the interests of workers and shareholders.”

Wall of Shame 12/2001 – Enron 12/2001 – Enron 6/2002 – Arthur Andersen and WorldCom 6/2002 – Arthur Andersen and WorldCom 1/2002 Global Crossing 1/2002 Global Crossing 12/2004 Kmart and Tyco 12/2004 Kmart and Tyco

The Big Three Enron Spurred corporate gov. movement Spurred corporate gov. movement Led to Sarbox Led to Sarbox Corporate greed (insider trading) Corporate greed (insider trading) Accounting fraud ($600 million) Accounting fraud ($600 million) Bad Corporate Governance Bad Corporate Governance Criminal trial Criminal trialWorldCom Fueled the flames Fueled the flames Led to Sarbox Led to Sarbox Accounting fraud Accounting fraud Wall Street involvement Wall Street involvement Federal indictment Federal indictment Ebbers found guilty Ebbers found guiltyTyco Corporate corruption Corporate corruption Accounting fraud Accounting fraud Misuse of funds by top execs. Misuse of funds by top execs. Federal indictment Federal indictment Kozlowski and Swartz found guilty Kozlowski and Swartz found guilty

Critical Legislative Events Surrounding Sarbox 1/17/02 - SEC Chairman Harvey Pitt proposes oversight board. 1/17/02 - SEC Chairman Harvey Pitt proposes oversight board. 4/25/02 - Senate Judiciary Committee approves H.R /25/02 - Senate Judiciary Committee approves H.R /12/02 - “Mark-up” of Sarbanes bill to occur. 6/12/02 - “Mark-up” of Sarbanes bill to occur. 6/26/02 - WorldCom fraud announcement. 6/26/02 - WorldCom fraud announcement. 6/26/02 - SEC files suit against WorldCom. 6/26/02 - SEC files suit against WorldCom. 7/15/02 - Senate passes S /15/02 - Senate passes S /19/02 - WorldCom files for bankruptcy. 7/19/02 - WorldCom files for bankruptcy. 7/30/02 - President signs bill into law. 7/30/02 - President signs bill into law.

With the Introduction of Sarbox Before Enron accounting fraud Enron accounting fraud Enron insider trading Enron insider trading Corporate swindling by top Tyco executives Corporate swindling by top Tyco executives WorldCom corporate fraud WorldCom corporate fraud Securities Fraud Securities Fraud After External auditors S.E.C. Increase of resources Increase of oversight and authority Extended power of governing bodies PCAB S.E.C. Increased Scrutiny

Current Trends Increased auditing costs Increased auditing costs Smaller public companies underestimated initial costs Smaller public companies underestimated initial costs Going Private Going Private Overreaction vs. Underreaction Overreaction vs. Underreaction Current costs steadied Current costs steadied

Organization of the Act – Eleven Titles, Numerous Sections Title I – Public Company Accounting Oversight Board Title I – Public Company Accounting Oversight Board Title II – Auditor Independence Title II – Auditor Independence Title III – Corporate Responsibility Title III – Corporate Responsibility Title IV – Enhanced Financial Disclosures Title IV – Enhanced Financial Disclosures Title V – Analyst Conflicts of Interest Title V – Analyst Conflicts of Interest Title VI – Commission Resources and Authority Title VI – Commission Resources and Authority Title VII – Studies and Reports Title VIII – Corporate and Criminal Fraud Accountability Title IX – White-Collar Crime Penalty Enhancements Title X – Corporate Tax Returns Title XI – Corporate Fraud and Accountability

Key Sections Section 302 The CEO and CFO of each issuer must prepare a statement to accompany the audit report to certify the ‘appropriateness of the financial statements and disclosures contained in the periodic report, and that those financial statements and disclosures fairly present, in all material respects, the operations and financial conditions of the issuer. The CEO and CFO of each issuer must prepare a statement to accompany the audit report to certify the ‘appropriateness of the financial statements and disclosures contained in the periodic report, and that those financial statements and disclosures fairly present, in all material respects, the operations and financial conditions of the issuer. Places responsibility for internal controls directly on the financial officers. Prior to the SOX Act, no US company had a system of controls in place that would completely satisfy Section 302.

Key Sections (cont.) Section 404 Requires each annual report of an issuer to contain an “internal control report”, which shall: Requires each annual report of an issuer to contain an “internal control report”, which shall: State the responsibility of management for establishing and maintaining an adequate internal control structure and procedures for financial reporting. State the responsibility of management for establishing and maintaining an adequate internal control structure and procedures for financial reporting. Contain an assessment (yearly) of the effectiveness of the internal control structure and procedures of the issuer for financial reporting. Contain an assessment (yearly) of the effectiveness of the internal control structure and procedures of the issuer for financial reporting. The most expensive and time-consuming Section of the SOX Act. The most expensive and time-consuming Section of the SOX Act.

Who the Act Applies To All public companies in the U.S. All public companies in the U.S. International companies that have registered equity or debt securities with the SEC International companies that have registered equity or debt securities with the SEC Plus the accounting firms that provide auditing services to them. Plus the accounting firms that provide auditing services to them.

Costs of Sarbanes-Oxley In 2005 In 2005 $5.8 billion spent to comply  up 5% from 2004 $5.8 billion spent to comply  up 5% from 2004 AIG has spent about $300 million per year to comply AIG has spent about $300 million per year to comply

Section 404 The costliest section The costliest section Requires assertions on effectiveness of internal controls over financial reporting Requires assertions on effectiveness of internal controls over financial reporting What are Internal Controls? What are Internal Controls? Safeguards that a company uses to monitor those who make financial decisions Safeguards that a company uses to monitor those who make financial decisions Preventing employees from inflating travel expenses Preventing employees from inflating travel expenses The process Dell uses to decide when a customer won’t pay a bill and needs to take a write-off The process Dell uses to decide when a customer won’t pay a bill and needs to take a write-off Documentation of control procedures related to IT Documentation of control procedures related to IT

Why is 404 so Expensive? The more complex the company the more controls are needed The more complex the company the more controls are needed SOX requires companies to dig deep and examine the effectiveness of their controls SOX requires companies to dig deep and examine the effectiveness of their controls Companies must set up independent audit committees Companies must set up independent audit committees Very time consuming and a drain on manpower Very time consuming and a drain on manpower  An average of 70,000 man hours for large firms  An average of 70,000 man hours for large firms Then an external auditor must attest that it has been done adequately Then an external auditor must attest that it has been done adequately And those auditors cannot do any other non-audit work for the company And those auditors cannot do any other non-audit work for the company

How Expensive is 404? Direct Costs Accounting and Audit Fees Accounting and Audit Fees To manage this cost many companies are either outsourcing or co-sourcing a number of audit functions To manage this cost many companies are either outsourcing or co-sourcing a number of audit functions Large Companies (> $5 billion) Small Companies (< $25 million) Overall Costs $4.6 million $2 million Internal Work 35,000 hours 1,150 hours External Work 6,200850

How Expensive is 404? Direct Costs (cont.) Boards of Directors and Audit Committees Boards of Directors and Audit Committees Boards and Audit Committees have increased the time spent on corporate governance since the passage of the Act Boards and Audit Committees have increased the time spent on corporate governance since the passage of the Act Directors are expected to have more input on company issues Directors are expected to have more input on company issues Personal liability insurance and consulting and legal fees have risen Personal liability insurance and consulting and legal fees have risen 31% of audit committees have hired outside advisors 31% of audit committees have hired outside advisors 44% plan to do so in the next year 44% plan to do so in the next year

How Expensive is 404? Indirect Costs Going Public Going Public Cost expected to double as a result of compliance Cost expected to double as a result of compliance Smaller, growing companies bear a larger burden of these costs Smaller, growing companies bear a larger burden of these costs More and more companies are going private More and more companies are going private Decision Making Decision Making Companies may become more risk adverse Companies may become more risk adverse Major decisions may take longer (and cost more) to implement Major decisions may take longer (and cost more) to implement Productivity Productivity Opportunity costs of revamping internal controls Opportunity costs of revamping internal controls

Concerns for Small Companies Source: The Economist, May 2005

Is It Worth the Cost? One company spent $1.2 million on controls and found an employee who had stolen $5,000 One company spent $1.2 million on controls and found an employee who had stolen $5,000 Companies have always accepted controls that weren’t perfect Companies have always accepted controls that weren’t perfect

Benefits Costs are “tangible, quantifiable, and immediate” Costs are “tangible, quantifiable, and immediate” Benefits are “intangible, harder to quantify, and long term” Benefits are “intangible, harder to quantify, and long term” Michael Oxley: “How can you measure the value of knowing that company books are sounder than they were before?” Michael Oxley: “How can you measure the value of knowing that company books are sounder than they were before?” Paul Sarbanes: “It’s an investment for the future” Paul Sarbanes: “It’s an investment for the future” Critics say that the companies are unearthing inefficiencies Critics say that the companies are unearthing inefficiencies T/R Systems has begun to write off old inventory sooner to comply with the law T/R Systems has begun to write off old inventory sooner to comply with the law At an April meeting at the SEC it was said that the Act had a “chilling” effect on the relationship between managers and auditors At an April meeting at the SEC it was said that the Act had a “chilling” effect on the relationship between managers and auditors Enron and Arthur Andersen Enron and Arthur Andersen

Companies are Still Adjusting Inconsistency in future compliance costs Inconsistency in future compliance costs Steelcase ($2.6 billion) and ACS ($3.8 billion) required 20,000 hours to comply Steelcase ($2.6 billion) and ACS ($3.8 billion) required 20,000 hours to comply Dell ($35 billion) required 5,000 hours Dell ($35 billion) required 5,000 hours Mid-sized companies estimate costs from $10,000 to $1 million Mid-sized companies estimate costs from $10,000 to $1 million Large companies estimate costs from $1 million to $5 million. Some as high as $10 million! Large companies estimate costs from $1 million to $5 million. Some as high as $10 million!

Other Effects Many of the large accounting firms have started to lose their clients Many of the large accounting firms have started to lose their clients Companies have saved 25-50% in audit fees by switching to smaller firms Companies have saved 25-50% in audit fees by switching to smaller firms 64% of Boards of Directors say that SOX has changed their roles 64% of Boards of Directors say that SOX has changed their roles

Costs Should Decrease Over Time A balance needs to be found between the costs and the amount of controls A balance needs to be found between the costs and the amount of controls Costs should drop off sharply in coming years Costs should drop off sharply in coming years Special rules may be added to assist smaller companies Special rules may be added to assist smaller companies

Some Thoughts on Complying with Sarbanes-Oxley “It’s so time consuming and laden with red tape that it’s like throwing buckets of sand into the gears of the market economy” – “It’s so time consuming and laden with red tape that it’s like throwing buckets of sand into the gears of the market economy” – Scott McNealy, CEO Sun Microsystems Scott McNealy, CEO Sun Microsystems “As a general rule of thumb, any bill that passes the U.S. Senate 99-0 is probably a horrible idea” “As a general rule of thumb, any bill that passes the U.S. Senate 99-0 is probably a horrible idea” Patrick Byrne, CEO Overstock.com Patrick Byrne, CEO Overstock.com “A pain in the ass” “A pain in the ass” Jeff Rich, CEO Affiliated Computer Services Jeff Rich, CEO Affiliated Computer Services It’s like “chemotherapy” after removing the tumors of Enron and Worldcom It’s like “chemotherapy” after removing the tumors of Enron and Worldcom Gary Smith, CEO Ciena Gary Smith, CEO Ciena

Sarbanes at Work…