Sarbanes-Oxley at 15: Keep, Reform, or Repeal?

Enron. It's a name we associate with corruption and fraud. Enron, which was an energy commodities and services company, filed for bankruptcy in 2001. It was found out later that its reported financial condition was supported by institutionalized and creatively planned accounting fraud. The Enron scandal gained such media coverage and infamous notoriety that 15 years ago, Congress responded with the Sarbanes Oxley Act, also known as SOX. This post-crisis regulatory push was created to improve financial disclosures and prevent future accounting fraud conducted by corporations. SOX was created with 11 Sections and the Public Company Accounting Oversight Board (PCAOB), the latter of which is a nonprofit corporation overseeing the audits of public companies to protect investors. Section 404 is the most infamous of the Sections since it requires both internal and external audit of financial accounting controls, which has the greatest impact on companies. How much has SOX improved upon information asymmetry? How much have investors been protected?

Protiviti, a global consulting firm, has tracked the effects of SOX through survey work since 2010. In its 2017 survey, the major finding is that compliance costs are increasing. Proviti found that the average cost for a company beyond the second year of compliance is $1.03 million. One the one hand, progress has been made in that compliance costs shortly after SOX was enacted ranged from $4-7 million. On the other hand, SOX costing an average of $1.03 million is significant because it shows that even after implementation and acclimating to complying with SOX, it still costs a significant amount to comply. And keep in mind that odds are that SOX is not the only regulatory framework with which companies have to comply or that audit fees more than tripled since the enactment of SOX.

Compliance costs are not the only metric we can use to determine success of SOX. Here are some more:

• The Protiviti survey had a couple of other interesting findings, the first being that more hours are being devoted to SOX compliance. The other one, which is in favor of SOX, is that 88 percent of respondents found some improvements in their internal control over financing (35 percent found "significant improvements").

• The number of financial restatements has increased since the implementation of SOX. A financial restatement is a revision and publication of one or more financial statements due to a previous material inaccuracy. If SOX was supposed to improve the quality of internal controls used for accounting, one would have expected a decrease in financial restatements. Instead, we see an increase, which implies that internal controls have not improved since 2002.
• Financial restatements under SOX come with another issue. Those who give advanced warning about internal-control issues not only gain nothing by doing so, but are actually more likely to be punished under Section 404 than firms that wait to restate their finances later (Rice et al., 2015). This disincentive potentially undermines the main purpose of creating SOX. 
• Two economists from Harvard attempted to take a cost-benefit approach to SOX (Coates and Srinivasan, 2014). Interestingly enough, they had a difficult time coming to conclusions about many aspects of SOX, including loss of risk taking, social welfare (e.g., IPOs), and whether SOX had any impact on the financial crisis of 2007-08. There were two main conclusions the authors were able to draw:
• Financial quality improved post-SOX, although the authors also admit that causal attribution is weak. 
• Direct costs of SOX fell disproportionately on smaller companies. 
• One criticism of SOX is that smaller companies have a harder time handling the compliance costs. Companies with market capitalizations under $75 million were ultimately exempt from SOX404(b). What was the net cost of this exemption? While $388 million were not paid in auditing fees, $856 million was left on the table in terms of future earnings had there been better internal controls (Ge at al., 2016). Whether or not this only applies to smaller companies or can be generally applied to all corporations is unknown. 
• The number of audit deficiencies identified by the PCAOB has increased since 2002. One could say that auditors are more diligent in identifying deficiencies. What counters that notion is that after fifteen years, one would think people have gotten hang of identifying deficiencies under SOX. The lack of decrease of audit deficiencies makes one wonder about the success of its internal controls, especially since financial statements remain the main source of information for investors. 
• The number initial public offerings (IPOs) on the stock exchange dropped. Obama's Council Jobs and Competitiveness noted that the number of IPOs smaller than $50 million dropped from 80 percent in the 1990s to 20 percent in the 2000s. The President of the New York Stock Exchange (NYSE) expressed concerns earlier this month that SOX makes it more difficult for startups to raise money through public offerings. Ernst and Young did publish a report in May 2017 saying that capital formation does not automatically need to happen in the stock exchange. Finding other sources of capital formation diminishes this concert. 
• There is also the question of cross-listing firms. Cross-listing is when a company shares its shares on at least one domestic stock exchange and one foreign stock exchange. If companies remove themselves from a foreign stock exchange, it means less economic growth for the given foreign market. A managing director at OTC Markets estimated that by removing themselves from the U.S. stock exchange to avoid SOX regulations, it saves a company an average of $10 million a year. A study from Tufts University also found that SOX had a negative impact of the value of firms worldwide (Bianconi et al., 2012).
• Another issue is hiring lower quality of talent in companies. Prior to SOX, it was common practice for employees of audit firms to work for their clients after they left their current employer. The familiarity with the company made for a better learning curve. The independence requirements of SOX put an end to that practice, which means it takes longer for new employees to learn the ins and outs of a company. 
• About half of C-suite executives believe that ethical behavior has improved since the implementation of SOX, according to Deloitte. Whether the corporate governance strengthened due to SOX or happened because of other factors remains unclear. 
• SOX comes with a moralistic issue. Under SOX, the government needs zero evidence of fraud to go through companies' books and determine whether or not it is a "fair" representation. Forget that something as seemingly objective as accounting requires judgment calls (e.g., here, here, and here), and that a financial statement is a product of multiple people making decisions about how the information should be presented. "Guilty until proven innocent" is not how the American judicial system is supposed to operate, which makes me wonder why we cannot simply gather evidence and prosecute individuals accordingly. The proof should be on the prosecutor to prove whether the internal controls were adequate in a certain case, not assume that companies either exist to defraud or are incapable of managing internal controls.  
• An irony of SOX is that the proponents believe that auditors misbehaved, and as such, SOX punishes that behavior. However, the response of SOX is to erect such high costs that the barrier to market entry protects the auditors that are alleged to have misbehaved.

I'm weary of the purported success of SOX, and not simply because it's the government being intrusive. Aside from success being far from clear (even for two expert Harvard economists), SOX has kept managerial staff more focused on trivial mechanics in accounting and less on other more vital tasks. Whether the costs of compliance outweighed the benefits of the improved financial reporting quality is ambiguous at best. Given the high compliance costs and other effects thereof, I would expect the proponents of SOX to better point out success of SOX.

Even if Congress is not going to go for downright repeal, it should at least reexamine Section 404 of SOX and enact some reforms: exempt businesses with market capital of $1 billion or less from Section 404, repeal "internal control" rules of Section of 404 or make them voluntary, abolish the Public Company Accounting Oversight Board, or clarify that criminal penalties for violation SOX require malign intent. Whatever Congress opts to do with SOX, I hope it is an improvement over the status quo of high compliance costs that have questionable effects of accounting quality.