The deadline to comply with a key provision of the Sarbanes-Oxley Act is fast approaching, and already companies are warning they may not meet the target date -- or will only do so after incurring huge costs.
The controversy focuses on a section of the landmark law that requires companies to document their so-called internal controls for preparing financial reports. The law mandates that companies' auditors evaluate their assessment. Companies with fiscal years ending on Nov. 15 will be the first to have to comply with the provision when they prepare their annual reports.
Some companies and business groups are calling the internal controls rule overkill, part of an overreaction by policymakers to
and other corporate scandals.
"I don't think drafters in the
Securities and Exchange Commission
and Congress anticipated the extent of the cost and management time that this is taking," said David Hirshman, senior vice president at the U.S. Chamber of Commerce. "The concept of stronger controls may be sound. But at some point you have to say, 'Is there a smarter way to do it?'"
But corporate critics counter that the provision is simply a cost of doing business, one that wouldn't take much time or effort if companies had been doing things properly all along.
"This is another situation where corporate America is looking for another excuse not to do the right thing," said Nell Minow, founder of the Corporate Library, a watchdog and research group.
Whether legitimate or not, the complaints are starting to pour in:
- Last week, wireless-networking company UTStarcom (UTSI) - Get Report warned that it might not meet the deadline for complying with the internal controls rule. The warning followed a delay in the company's quarterly report and an admission by the company that its controls on revenue recognition had "deficiencies."
- In recent weeks, Homestore (HOMS) and Media General (MEG) missed analysts' quarterly earnings expectations. Both companies attributed their disappointing results in part to rising administrative costs related to complying with Sarbanes-Oxley. While not necessarily missing estimates, companies such as Audible (ADBL) , Hot Topic (HOTT) , Sharper Image (SHRP) , La Quinta (LQI) and others all have warned that conforming with the internal controls rule already has resulted in increased costs, and that those costs will weigh on their bottom lines in coming quarters.
Internal controls are essentially a system of checks and balances designed to prevent and detect fraud and errors. Such a system might require, for instance, that an employee who mails invoices is different from the person who counts the checks that come in from customers.
Most companies already have such systems in place in one form or another. But many have never completely documented their internal controls.
To date, few companies have echoed UTStarcom's warning. But some corporate representatives believe that will change as the deadline nears.
Allied Defense Group
, for instance, plans to comply with the internal controls provision, but CEO John Meyer has some concern about whether the company can do so in time. Of particular concern is what happens if Allied's auditor tells the company at the end of the year that its internal controls need more work, he said.
"I don't know if we're going to have enough time," Meyer said. "I will submit to you that there will be a lot of companies that don't get it finished or don't get it right."
Regardless of how many companies have trouble with complying, many already are finding their costs rising sharply.
In a July survey of 224 public companies, financial executives estimated that conforming with the internal controls rule will cost their companies about $3.14 million each, according to Financial Executives International, a professional organization representing corporate CFOs, treasurers and controllers. That estimate is up 62% from one made in January by FEI, which attributed the rise both to internal costs and external fees paid to auditors and consultants.
"Both internal and external costs are ballooning," said Grace Hinchman, senior vice president at FEI.
Those costs are hitting smaller companies especially hard, critics of the provision charge. Such companies typically have small accounting departments, meaning that they may have to hire extra employees or outside consultants just to get their systems up to speed.
At Allied, for instance, each of its six subsidiaries typically has just two or three people in its accounting department, Meyer said. Those employees already are working full time on their standard duties, such as preparing financial reports, he said.
Because those workers have had little extra time to meet the internal controls requirements, Allied has hired PricewaterhouseCoopers to help review and structure its internal controls before its regular auditor, Grant Thorton, can assess them, Meyer said.
As a result, he estimated that complying with the internal controls provision could cause the company's auditing fees to double the $340,000 the company paid last year. If so, the company's auditing fees would amount to nearly 8% of the net income it posted last year.
"This has proven to be extremely costly," Meyer said. "This has been extremely time-consuming and frustrating."
Many observers expect the costs to subside somewhat after the first year, attributing much of the jump in fees and expense to companies having to get up to speed with the new rule. But some companies and experts warn that many of the costs may be a continuing expense.
Under SEC rules, for instance, companies and their auditors will have to test their control systems annually.
How much of the costs are one-time and how much are recurrent is a "real concern," said Jack Endean, president of the American Business Conference, which represents small and medium-sized growth companies.
"I don't think there are any reliable, objective studies because the experience is so new," Endean said.
Some observers think the auditing industry is responsible for much of the rising costs. Auditors are -- or will be -- closely scrutinizing companies' internal controls. After the demise of Arthur Andersen, none of them want to be held responsible for letting something slide, accounting experts say. While understandable, that extra scrutiny entails extra costs, critics say.
The accounting firms are being "totally protective of themselves," said Jeff Brotman, managing partner of Ledgwood Law Firm, which represents a number of public companies working to comply with the internal controls rule.
"Somewhere out there is the person who will be the poster child that blew Sarbanes-Oxley. Nobody wants to be that guy," Brotman said.
But corporate managers are facing those fears, too. And some observers think that accounting firms are playing on that fear to "gold-plate" their audits by either overcharging or by charging for services that companies don't really need. Helping them do that is the fact that Arthur Andersen's demise has led to limited competition.
"I don't believe the auditors went into this thinking they're going to get wealthy, but they now have an umbrella above them: If you want their imprimatur, this is what it's going to take -- take or leave it," said Allied's Meyer. "I know they have some increased pressure on them, but those costs are being passed to their customers, to yours truly."
Accounting industry representatives deny that they are gold-plating their services.
"Are public accounting firms gouging clients? The answer is no, they are not," said Stephen Wagner, co-chairman of the Sarbanes-Oxley steering committee at accounting giant Deloitte Touche Tohmatsu.
Indeed, some accounting experts believe the auditors are merely doing what is required of them under the law.
"The auditors don't have a choice," said Chuck Mulford, a professor of accounting at Georgia Institute of Technology. "They have to make sure the clients evaluate these things. And they have to make themselves comfortable that the client has evaluated these things. That's an expensive undertaking."
And some observers blame the companies themselves for the expense. Good companies already should have had control systems and documentation in place, said Elliot Schwartz, director of research at the Council of Institutional Investors. It's quite possible that many companies were underinvesting in their auditing departments, Schwartz said.
"The appropriate baseline for measuring the extra costs isn't necessarily what companies were spending before Sarbanes-Oxley," Schwartz said. If a company had only one person in its accounting department, "maybe they should have had two to begin with," he added.
Not every company is having trouble complying with the internal controls rule, accounting experts noted. Many companies either already had good systems in place or got a jump start on complying, they said.
"Some are way far ahead of the pack," said Deloitte's Wagner. "Where the noise is coming from is from those who started late and were more surprised about
the magnitude of the effort required under the law."
Regardless, companies shouldn't be looking to the SEC for relief. The SEC already pushed back the deadline for complying with the new rule from June to November.
companies would have the maximum time they could get" to comply with the rule, said Donald Nicolaisen, the chief accountant of the SEC. But, he added, "I think they have had enough time."