Michael Oxley has been guaranteed immortality — and perhaps a degree of infamy — since his name was affixed to the Sarbanes-Oxley Act of 2002, the most comprehensive set of corporate rule changes since the 1930s.
Earlier this year, Oxley retired from Congress after serving 25 years. However, the 63-year-old Republican from Ohio is not ready to fade from the scene. In the past month, he has picked up two new jobs: as counsel for the Cleveland-based law firm Baker Hostetler and as nonexecutive vice chairman of Nasdaq.
The act that bears his name missed unanimous passage through Congress by a mere three votes in the House of Representatives, and initially received grudging lip service from a shaken Corporate America. But a little-noticed section, just 168 words long, soon changed the debate from whether Sarbox was essential to restoring confidence in the U.S. capital market to whether it was destroying it. Section 404, which requires companies and their auditors to examine and report on the processes behind their financial reporting, quickly became the most expensive and hated provision of the act.
Today, Sarbox, and particularly 404, are under heavy attack, as are many of its accessory creations, most notably the Public Company Accounting Oversight Board. Both the president and many in Congress have said the act was poorly implemented, a criticism that neatly deflects the blame from those who made the law to those charged with implementing it. Technically, that’s the Securities and Exchange Commission, although almost all of the critics leveling that charge are actually referring to the PCAOB.
In his final months in Congress, Oxley took to the hustings to defend the act, but more recently has joined the chorus of voices who say that the act, if not wrong itself, was poorly implemented.
Ironically, the loudest protests seem to be taking place after the largest companies have been through the worst of the compliance effort, but the result appears to be that small companies are likely to be spared the same degree of pain.
At Nasdaq, Oxley will serve as an adviser to Nasdaq president and CEO Bob Greifeld and the board of directors. In fact, he is about to join Greifeld on a listening tour to meet with CEOs and CFOs of listed companies and to discuss recent efforts at the SEC and PCAOB to tweak the rules of the law he wrote. He’s likely to get an earful.
Oxley recently took time out to discuss the Sarbanes-Oxley Act and its many challenges with CFO.com contributing editor Stephen Taub.
Are you happy with the way Sarbanes-Oxley has been implemented?
Not really. The law has gotten a lot of criticism.
Why do you think this happened?
The main thing is the enormous cost that was driven by the outside audit. But, the auditors are under tremendous pressure too. Audits should be risk-based so companies can better assess the risks involved and move forward.
Why are the auditors under so much pressure?
It was Auditing Standard No. 2 [the standard for auditing internal controls over financial reporting], promulgated by the PCAOB, that started all the problems.
Why did it start with AS2?
Of the complaints you hear [about Sarbox], 99.9 percent are about 404. It was two paragraphs long, but by the time the PCAOB was done, it was 330 pages of regulations. It was far too prescriptive and [more] expensive than anyone anticipated. So, [the PCAOB] and the Securities and Exchange Commission proposed a risk-based assessment to better define material weakness, with more emphasis on internal audit. It adds flexibility with smaller companies. Those are common-sense proposals that I am confident will be adopted this year with a 5-0 vote, which would be a ringing endorsement of [SEC chairman Christopher] Cox’s leadership and reaffirmation that the SEC and PCAOB want it to work in a more efficient manner. It will protect the investor and make regulations work to everyone’s satisfaction.
You don’t have a problem with backing away from AS2?
Now is the time to revise it and wring out costs. This is how the system works. We had the foresight to put in the kind of flexibility in [Sarbox] that allowed the SEC to defer smaller companies to comply. It is the same with foreign listings. This is a work in progress. It is not unusual to have regulators make changes in a broadly based statute. Some changes are necessary and good. This is the system, and it is working well. File off the rough edges and make it work for everyone. This will be one of those classic events.
In retrospect, if you had more time, would you have made different provisions for small companies?
Our committee’s first hearing was December 2001. They signed the bill July 30, 2002. It was not rushed. When the House passed our version in April 2002, they did not have 404 in the bill. It was added in the Senate part after WorldCom. The answer is yes, in retrospect. If we had more time, we could have proposed a laddering of applications. That’s hindsight. At the same time, the key was the flexibility it gave regulators.
Why was 404 inserted after WorldCom?
WorldCom changed everything. It sucked the life out of the room. It was four times larger than Enron. Everyone was already exhausted by Enron. Then WorldCom took everyone’s breath away. It was just amazing. It pushed the Senate toward adopting 404. It was really taken from a banking statute. It is a highly regulatory regime [intended for banks] that is superimposed on publicly traded companies. So, banks ended up with the worst of all worlds — existing banking regulations and [Sarbanes-Oxley]. I even discussed exempting regulated financial institutions, but I didn’t win.
Are you glad you didn’t win?
I honestly believe they should have been exempted. Individual banks, not the holding companies, which take on the structure of a corporation. For banks, it is an unnecessary regulatory burden [in addition to those] they are already complying with.
You said a few years ago that “Most CFOs I talk to can quote the act’s cost down to the dime.” Do you still feel this way?
That’s their job, to count down to the dime. They wouldn’t be doing their job if they didn’t. But, it is important to weigh the costs with the benefits. As the PCAOB gets us back on track in terms of the benefits versus the costs, they will protect the investor and make it more cost-effective. Sarbanes shares that sentiment. I think they found the sweet spot.
What do you think of the groups that want to kill Sarbanes-Oxley altogether, arguing it was a bad idea?
The federal court just kicked out a lawsuit. [In late March, a U.S. District Court judge dismissed a lawsuit challenging the constitutionality of Sarbox's creation of the PCAOB.] It’s now on appeal. They don’t appear to have a whole lot of traction. If you look at total market cap on July 30, 2002, for public companies and today, it is pretty hard to argue that Sox has been a detriment to growth and prosperity. It has provided a certain degree of comfort to the investing public and a confidence level in the investing public has been restored. Markets are more transparent. Accountability is built into the process. A lot of people overlook the requirement that insider deals must be reported in 48 hours. This provision is interesting in light of the backdating scandal. Virtually all cases took place before 2002. Before that, they had up to 90 days to report [stock trades]. I think the transparency will preclude nefarious activity. The statute does get credit for this.
What about reports that the SEC will have more authority over the Financial Accounting Standards Board? Will FASB become more politicized?
In some sense, it will always be politicized. Remember the number of hearings on its proposal to expense stock options? You can’t get rid of it. Even [former SEC chairman Arthur] Levitt, who had concerns [about FASB losing its independence as an accounting standards–setter], was supportive of what is about to transpire. I have great confidence the SEC knows what it is doing, won’t overstep its bounds, and will provide some sort of order to the process.
So, you’re not concerned this will undermine FASB’s independence?
I think everything will be transparent. It doesn’t keep me awake at night.