The SEC Opens Up SarbOx

(page 2 of 2)

"It's very important that we write specifically into the rule a provision to allow more judgment on the part of auditors and management," says Wayne Kolins, national assurance director at BDO Seidman, a Chicago-based financial-services firm.

But if major cost-cutting isn't on the table, what's driving the demand to tinker with the regulations? The real benefit of change could be a legal one—a shield from exposure to shareholder lawsuits. Without specific direction from regulators, companies fret that anything intimating even the slightest hint of a shortcut could leave them vulnerable to expensive shareholder litigation. It's that fear, probably as much or more than actual compliance costs, that's driving the call for change.

Cost of Compliance

Indeed, although conventional wisdom has pegged Sarbanes-Oxley compliance as exorbitantly costly, the compliance standard is not quite the crisis business has made it out to be. The now-infamous $1.4 trillion cost of the law, a figure calculated by measuring the drop in stock market capitalization during July, 2002, when the legislation was passed, has been widely discredited.

More recently, studies based on surveys of actual costs show much smaller numbers, though they continue to outpace the $91,000-per-company cost—or $1.24 billion—estimated by the SEC when it issued its guidance. Hackett's Roth puts the current average cost of compliance at 0.25% of a company's revenue, down 3% from a year ago. So-called "world-class" operations, which have less complex internal controls, spend even less—about 0.14% of revenue, including direct compliance costs and outside auditing fees.

Not Going to Capitol Hill

Political and procedural realities dictate that any final set of changes won't have a remarkably significant impact on how SarbOx is implemented. Business has pushed for reform at the agency level instead of turning to Congress for a rewrite of the law, in part, because lobbyists fear that reopening the law, especially in the new, Democrat-controlled Congress, risks making it worse.

That means regulators will have to work within the confines of the existing statute, which limits their latitude to make changes. The SEC, for example, won't likely be able to exempt smaller businesses from the most onerous sections of the audit standards without getting the law changed.

Woellert is a correspondent in BusinessWeek's Washington bureau.