As we approach the five-year anniversary of the passage of the Sarbanes-Oxley Act (SOX) many questions remain about the effects the legislation has had. It was implemented to improve investor confidence, but has its cost outweighed the benefits that it provides to both management and the investor?

The numbers exist regarding the substantial cost of implementation and compliance of SOX, but the long-term benefits are just now beginning to present themselves. According to a 2007 study conducted by Oversight Systems, 41 percent of financial executives report that SOX builds overall confidence in the market, and 37 percent report that SOX increased shareholder value because investors know their company is operating ethically.

The Securities and Exchange Commission (SEC) continues to hear suggestions regarding how to improve the SOX process and make it more "user friendly." In July 2007, for instance, the SEC announced changes to auditing standards that move the SOX process to a more risk-based approach, which is intended to make the audits of publicly traded companies more scalable to company size and complexity while ensuring the primary reason for SOX  – investor confidence. These revisions, and others to come, will continue to reduce the cost of compliance and regulation from SOX.

Much has been learned through the first five years of SOX implementation and much more is still to be learned. The true meaning of SOX – why the law was passed – is based on investor confidence. Without investor confidence our markets would be in shambles. From that perspective, SOX has accomplished what it was intended to do. If it is doing more than intended, it is a story that is not yet finished.

McKonly & Asbury, has been involved with SOX implementation at a number of organizations in Pennsylvania. What we have found is that complete management buy-in is critical to the success of this initiative, ongoing internal controls education is a must, and retention of experienced internal controls experts to manage the process provides many companies with long-term cost reductions.

Management Support

Top management needs to drive home the importance of internal controls throughout the organization and demonstrate a commitment to high ethical standards of conduct.  This sets the tone for the entire organization.  Areas of emphasis include increased oversight accountability by the board of directors; the need for independent directors with strong business and financial understanding; and independent oversight of commitments to internal controls and ethical standards.  Effective board involvement also will discourage management overrides that can invalidate a good system of internal controls.

Educate Your Organization

Education is key to the implementation and maintenance of a successful internal controls system. While education sounds like a simple concept, it is not. Internal controls concepts are new to many people within the organization, and reorganizations, process changes, market changes, and other factors create a need for a continuous learning process to sustain the internal controls system. Some organizations view internal controls procedures as a reduction in efficiency, but successful companies have a different mindset. They recognize that proper implementation of internal controls can increase operational efficiency.

Retain Internal Control Experts

Holding onto seasoned internal controls experts is important for effective implementation and monitoring of SOX compliance.  Frequently, the level of talent needed is not available on the market, and must be obtained from an experienced consulting firm.  If you have to hire somebody, look for someone who can educate your staff to a point where you can maximize the efficiency of the SOX compliance efforts. 

David B. Blain, a certified public accountant, accredited in business valuation, and certified valuation analyst, is a senior manager with McKonly & Asbury LLP in Camp Hill, PA. He is a member of the Pennsylvania Institute of Certified Public Accountants (PICPA) and is a contributor to Pennsylvania CPA  Journal.  To contact Mr. Blain, please email him at dblain@macpas.com.