With a new round of reform in place, it’s worth an update on the response to the last financial crisis.

By Juliette Fairley

When the U.S. Supreme Court in June struck down one part of the Sarbanes-Oxley (SOX) financial regulations, a moment of uncertainty ensued as observers scrambled to interpret the decision. As it turned out, the court had made a fairly technical revision to the law’s oversight board, based on a separation of powers argument that will give Presidents a freer hand to replace members of that board. Yet while that could prove an instrument of regulatory enervation down the road, the reality was that the law’s critics were dealt a blow. The high court had upheld the spirit, and much of the letter, of SOX.

When the Senate investigated Enron in 2002, it mandated additional regulations under Sarbanes-Oxley for four groups that had oversight responsibility for the embattled company: auditors, boards of directors, securities analysts and government agencies. “Hearings did not include investment banks or credit rating agencies, which are two of the culprits that have their fingerprints on the Great Recession,” says Keith T. Darcy, executive director of the Ethics and Compliance Officer Association, a leading provider of ethics, compliance and corporate governance resources based in Waltham, Massachusetts. “Sarbanes-Oxley served most industries and companies very well, but it didn’t go far enough. Rating agencies and investment banks didn’t get new regulation.”

SOX was an amendment to the Securities Exchange Act of 1934, enacted in 2002 to cause auditing firms to remain objective and independent of their clients. This came after it was discovered that Enron's provider, Arthur Andersen, was allegedly applying reckless standards in their audits, because of a conflict of interest with consulting fees generated by Enron. In 2000, Arthur Andersen earned $25 million in audit fees and $27 million in consulting fees servicing Enron.

“At the time, it was the strongest piece of business regulation since the Great Depression, so it needs to be applauded for getting people’s attention. In hindsight, we can say there should have been oversight and regulation of Wall Street, but the haste in which the bill was passed didn’t allow them to interrogate Wall Street and the rating agency’s role in the scandals of Enron and Worldcom and the other companies that emerged,” says Darcy.

Rating firms such as Moody’s and Standard & Poor’s have been criticized for misjudging the risk of debt instruments, which are at the core of the 2008-2009 financial meltdown. The carnage from the crisis resulted in record personal bankuptcies; home foreclosures; General Motors and Chrysler declaring bankruptcy; AIG, Fannie Mae and Freddie Mac becoming wards of the state; 15 million unemployed workers; a federal deficit of $1.3 trillion; federal debt of $13 trillion; and investment banks Bear Stearns, Lehman Brothers, and Merrill Lynch disappearing from the face of the earth.

“Pressure from underwriters and deal sponsors who accounted for much of their business and profits caused rating agencies to adjust their valuation models, overriding them much of the time, to produce the inflated AAA ratings that clients wanted,” says Columbia University Law School Professor John C. Coffee, a noted expert on corporate governance and securities regulation.

Under existing federal securities law, credit rating agencies were not subject to any risk of liability, and faced almost no competition and no oversight by any regulatory body. (That said, there was a 2002 settlement with then-Attorney General of New York Eliot Spitzer, in which 10 major firms agreed to pay $1.4 billion to sever the links between research and investment banking, including analyst compensation for equity research and the practice of analysts accompanying investment banking personnel on pitches and road shows.)

“Without admitting or denying, they recognized that the issue at hand was conflicts of interest between the analysts and the investment bankers,” says Darcy. “Analysts were getting paid by investment bankers to promote stocks they were underwriting securities for, but it didn’t get to the rating agencies. Sox didn’t go far enough to include investment banks and credit rating agencies.”

The Franken Amendment to the recent financial reform bill picked up where SOX dropped the ball by imposing tighter regulations on credit rating agencies. Sponsored by Senator Al Franken, D-MN, it creates an oversight board run by the Securities and Exchange Commission (SEC) called the Credit Rating Agency Review Board. “SOX subjected accountants and auditors to close regulatory oversight. As a result, the rate of accounting restatements decreased. The Franken Amendment will do the same for the rating agencies,” says Coffee.

Critics of the amendment think a board overseeing rating agencies would, among other things, increase borrowing costs by delaying the securitization process. “Having the rating agency assigned by a third party, whether the government or its designee, could lead investors to believe the resulting ratings were endorsed by the government, thereby encouraging over-reliance on the ratings,” says Ed Sweeney, spokesperson with Standard & Poor’s.

Like rating agencies, investment banks were allowed to continue with business as usual when SOX was enacted. At the time, investment bankers crafted debt securities that allowed Enron to misstate its financial statements and mislead investors, according to Gary M. Brown, a Baker, Donelson, Bearman, Caldwell & Berkowitz board governance attorney. To make matters worse, under the Supreme Court decision in Stoneridge Investment Partners v. Scientific Atlanta, bankers and lawyers actively structuring and marketing these transactions could not be held liable, because the alleged misstatements or omissions were not directly attributed to the banks or law firms in offering documents. In Stoneridge, the justices ruled that investors cannot sue third-party businesses, such as law firms, accountants, banks, and other suppliers for their role in public companies deceptive practices to inflate stock prices. “You can have all the laws and regulation you want, but there will always be corruption,” says Brown. “You just need to determine if there are sufficient disincentives for fraud, corruption—and, for those who are caught defrauding, that there are sufficient penalties to dissuade that kind of conduct.”

SOX 404(a) requires management to assess the effectiveness of the company’s internal financial controls while 404(b) requires an auditor to attest to management’s assessment, which has proven to be a challenge for smaller companies with a market capitalization of less than $75 million (which are also known as non-accelerated filers.) “I find the complaints from smaller firms to be misleading,” says Marc Levinson, a senior fellow with the Council on Foreign Relations. “The cost of compliance is borne by the shareholders of the public firms, not by the managers, and I don’t hear the shareholders complaining.” There are a lot of complaints about SOX from CEOs and CFOs but not from investors. I think that tells you something about the value attached to SOX.”

According to a study by Audit Analytics, the severity and number of financial restatements fell for the third year in a row from 923 in 2008 to 674 in 2009 as a result of SOX requirements. “The decrease in restatements means Sarbanes-Oxley is successful, because it created a different expectation, mind set and focus on internal controls over financial reporting,” says Don Whalen, director of research with Audit Analytics. “At first, we had an increase in restatements, but as internal controls improved, the financial reporting started to improve. I believe this is a manifestation of SOX 404.”

The causes of restatements in 2009 were largely the same sorts of problems that always dog companies: debt, quasi-debt, warrants and equity issues, accounts receivable and compensation problems. About 18 percent of restatements were a result of quasi-debt, compared to 12 percent of restatements caused by accounts receivable loans. (Quasi debt is defined as errors or irregularities associated with debt or equity accounts arising from debt instruments.) The number of restatements by non-accelerated filers, exempt from most of Section 404, reached 888 in 2006 and has since decreased to 374 restatements in 2009, which is more than the number of restatements by accelerated filers.

Much to the consternation of industry observers, the Obama Administration recently exempted smaller publicly traded companies from having their auditors audit internal controls. “Even though non-accelerated aren’t required to file, some of the requirement did flow down in anticipation of having to file,” says Whalen. “Whether non-accelerated filers will get more relaxed because of the relief on that requirement will be revealed in the financial statement trends of the future.”

Not everyone in the industry is so forgiving.

“If complying with SOX is so difficult that small companies don’t have to comply, then large companies shouldn’t have to comply either,” says Open Compliance and Ethics Group (OCEG) Chairman and CEO Scott L. Mitchell. “It’s frustrating to see different rules apply.”

A big red flag should be tacked on the back of those non-accelerated filers not being required to comply with SOX, according to Andrew D. Bailey, professor emeritus of accounting at the University of Illinois Urbana-Champaign.“Everybody should know that non-accelerated filers are not complying,” says Bailey. “There’s a free-riding aspect associated with the waiver.”

Despite fewer restatements, OCEG’s Mitchell complains that increased oversight cannot change the fact that SOX lacked definition in requiring companies to only file the information in narrative form with the SEC. “What the government needs to do is publish the financial reporting information in a more structured format so that people can read these disclosures when they’re made,” says Mitchell. “Government is failing us by not creating the equivalent of an information highway system for public consumption. For example, XBRL and GRC-XML represent the highway system of information. When you specify the format, you increase transparency.”

The eXtensible Business Reporting Language (XBRL) is a standard format for the electronic financial reporting of business information. European Union countries, China and Japan already have XBRL mandates in place. GRC-XML is a technical standard providing common language for risk and controls.

While implementation of SOX is no longer much of an issue, one area in which many Wall Street firms have frequent questions is prohibitive loans to executives. The SEC investigated WorldCom about its accounting practices as well as loans to officers. The largest of those was $366 million in loans to former Worldcom CEO Bernard Ebbers at interest rates between 2.2 and 7 percent. The company made the loan after a drop in the value of Ebbers’ WorldCom stock that had been used as collateral on a separate line of credit. WorldCom filed for bankruptcy protection in what was then the largest corporate insolvency in history.

“My clients call to ask me questions about independence on the board and about the audit committee. They ask questions about the relationship with outside auditors and about prohibitive loans to an executive,” says Laurie A. Cerveny, a partner with the law firm Bingham McCutchen’s practice who counts a major Wall Street investment banking firm as one of her clients.

Under SOX, most companies are prohibited from making loans to executives or directors, but it exempted banks from loan restrictions, because banks are in the business of making loans. Foreign banks such as Credit Suisse did not receive the exemption initially. The SEC added the exemption in April 2004.

Clawbacks of cash bonuses and the proceeds of sales from stock as executive compensation is another area in which many think SOX could have made a stronger impression, but didn’t. Under SOX, executives were required to return stock proceeds only if the government brought action for misconduct and restatement of incorrect accounting results occurred. “I would have liked to have seen a stronger clawback provision that allowed other parties to recover money and that did not require misconduct on the part of the executive and that didn’t require a restatement,” says Harvard Law School Professor Jesse M. Fried, a specialist in executive compensation and corporate governance issues.

When a company misreports an executive’s earnings, thus allowing the executive to make more money through cash bonuses or sale of stock, clawbacks allow parties to go back to get the money from the executive. “The expanded clawback provision passed on May 20, 2010 by the Senate does what Sarbanes-Oxley didn't do. It allows for financial recovery even if the government uncovers no misconduct by an executive,” says Fried.
While legislating executive compensation might not be the answer, Bailey has strong opinions about the use of stock options. For example, incentivizing stock options under SOX could have focused management on the long term. “Stock options are wonderful, but it’s an incentive system that needs to be managed. Directors should never have stock options that can be exercised less than five years after they are off the board. The board should be incentivized for long-term decision making,” says Bailey.

Under SOX, all high-level executive stock option grants and exercises made on or after August 29, 2002 had to be reported within two business days. Prior to SOX, it was 10 days. At the time the SOX second-day reporting requirement was passed, shareholders and regulators were unaware that firms had been backdating executives’ option grants and exercises.

“Backdating was a practice in which executives would choose grant dates for their stock options over the past months so they would get the exercise price set low,” says Harvard’s Fried. “SOX changed the reporting requirements about stock-option grants, which made it more difficult to backdate.”

Despite SOX, 15-to-20 percent of publicly traded companies disregarded the new disclosure requirements, suggesting that SOX didn’t do enough, according to a study entitled Option Backdating and Its Implications by Fried. “People weren’t following the rules,” he says. “In retrospect, it would have been desirable to have harsher penalties for those not following SOX, so disclosure rules.”

SOX was a bill intended to speak to publicly traded corporations—not Wall Street. “I don’t think SOX contributed to the financial crisis. What SOX failed to do was create an environment in which the risks these people were facing were assessed in an objective manner,” says Bailey. “If anything, SOX did not provide a strong enough focus on governance and oversight of management.”

The question is whether, and if so when, business will embrace an ethos that transcends compliance. “SOX gave birth to the ethics industry,” says Darcy. “We have come to the understanding that compliance is not sufficient. Enron was compliant but look what happened. We must balance our financial budgets and moral budgets. Investigators, regulators, and prosecutors are looking to see that businesses have taken extra legal measures to build a culture of integrity in their firms. You must build a foundation of integrity by attending to cultural issues.”
The financial reform recently signed by President Obama might be just the impetus businesses need to focus on integrity. “I don’t care how much infrastructure you put in or how many manuals are written, you’ll have these problems if top management actions are not based on a solid ethical standard,” says Bailey.