Getting SOX Right

Recent talk of overhauling accounting regulations has the potential to turn the business world upside down.

Last week, Federal Reserve Chairman Ben Bernanke argued in favor of the U.S. developing a U.K.-style, principles-based, risk-focused approach in its financial market regulation. This comes only a few weeks after the chairman of the Securities and Exchange Commission, Christopher Cox, said the U.S. and Europe should be able to achieve a single accounting standard by 2009. But perhaps more urgent, on Wednesday the SEC is expected to release its final guidance to management for implementing Section 404 of the Sarbanes-Oxley Act of 2002.

The SEC is certainly keeping busy, but is it taking the right approach?

Let's back up for a moment. With the perpetual debate surrounding SOX, there's absolutely no question the legislation came about because we needed it. Enron, Tyco International (nyse: TYC - news - people ), Peregrine Systems and WorldCom are still the buzzwords for what can go wrong when American businesses are not held accountable to shareholders.

So when SOX came along, it was supposed to be The Answer that would restore shareholder confidence and make Corporate America a key global player again by emphasizing sound internal controls and honest financial reporting. But SOX was immediately controversial, and its implementation has been counterproductive and costly--and it has eroded, instead of enhanced, shareholder value.

The SOX debate has found passionate proponents and critics--all with the interest of helping Corporate America return to the business of creating economic value. Last December, the SEC and Public Company Accounting Oversight Board (PCAOB) finally acknowledged it was time to fix what went wrong. To help solve the problem, they introduced a draft of interpretive guidance for management's assessment of internal control--basically, a set of directions for better implementing SOX from inside a company.

Following nearly five years of confusion, the new SEC guidance is absolutely critical for American business and our economy as a whole. But the SEC needs to ensure that the "directions" match up to the level of investor protection, and that they will work for businesses of all sizes. To get it right, the SEC must establish practical implementation guidance to management, so that management truly is accountable for complying with SOX Section 404. The auditor's only job should be to verify that management has followed the guidance. This is consistent with auditing practices; it will never make sense to have the auditors telling management what the rules should be. That is what the standards setters, like the Financial Accounting Standards Board, and regulators, like the SEC, are there to do.

There's been much talk lately about how American regulation is affecting the nation's economic competitiveness and about the possibility of New York slipping behind London as the financial center of the world. So it's easy to see why the SEC is taking management guidance seriously. But we urge the SEC to get it right.

Issuing possibly inadequate guidance for management isn't in America's best interests and may not change the current state of inefficient SOX compliance practices. There still remain a number of key issues that have been highlighted by the Institute of Management Accountants (IMA), the U.S. Chamber of Commerce, the Small Business Administration Office of Advocacy and the Institute of Internal Auditors. To be effective, the SEC guidance needs to:

--Take a risk-based approach, according to globally recognized standards.
--Adjust current requirements in financial statements to achieve effective internal controls over financial reporting.
--Minimize use of the external audit opinion on management’s internal controls.
--Be scalable for use by small businesses.

To protect investors at reasonable cost and enable American businesses to remain competitive, the factors above must be resolved first. For this reason, it is essential the SEC postpone its final ruling. Since we've already waited this long, let's get it right before rushing to new, possibly again dysfunctional legislation. Instead, IMA believes the SEC ought to:

--Release a revised exposure draft of SOX guidance for management, addressing the additional compliance issues described above.
--Allow small-cap, non-accelerated filers an additional one-year extension for SOX compliance while the guidance draft is revised.
--Allow accelerated filers the benefits (i.e., reduction in compliance requirements) of the revised Audit Standard immediately.

Make no mistake: We applaud the SEC and PCAOB for their attempts to provide practical and appropriate guidance to management and external auditors. We're pleased the SEC recently recognized the need to align guidance for management with the PCAOB's proposed audit standard. This situation was the No. 1 SOX compliance issue and is the primary source of costly over-auditing practices.

However, more needs to be done to achieve cost-effective SOX compliance programs. And much more needs to be done to restore shareholders' confidence in U.S. businesses and ensure the future of America's economic competitiveness.

Paul A. Sharman is president and CEO of the Institute of Management Accountants.

http://www.forbes.com/opinions/2007/05/22/sarbox-sec-revamp-oped-cx_pas_0523sarbox.html