Sarbanes Pain Becomes Politics

Notably, Congress didn't want auditor evaluations to increase charges or fees. But they have, disproportionately so for small companies. The report cites data from the American Electronics Association that compliance costs totaled nearly 3% of revenue for companies with market values below $100 million, with larger companies spending less than half a percent of revenue.

Until the framework for assessing internal controls can be better tailored to small companies, the panel said, the SEC should exempt them from the costs of an outside auditor mandated by Section 404. But in exchange for that relief, companies need to make auditors answer to the audit committee, not management.

"Given the landslide of legislative and regulatory changes, let's step back and ask the question: Have we struck the balance right? I think we've gotten it mostly right, but not with the implementation of 404," says Steven Bochner, a partner at Wilson Sonsini Goodrich & Rosati and a member of the advisory panel.

Not surprisingly, there is almost as much debate over the panel's central recommendation of exempting small companies from outside auditors as there is over Section 404 itself. Critics point out that the law will exempt nearly 80% of all public companies. Proponents say that it will only affect a mere 6% of the U.S. stock market capitalization. Both points, equally compelling taken on their own, are also equally valid.

And here's what the disagreement comes down to: Annual reviews from outside auditors are usually worth the cost for large companies, but not for small ones. Sarbanes-Oxley took a compliance template from big firms and made it apply to big and small alike.

The question now is, can the law be tailored for small companies without rolling it back?

Or as Bochner puts it, "Do you fix an airplane in the air or do you ground it? Some people are saying, let's work it out. But I'm saying that this is so far off the mark we've got to ground the airplane."