The Sarbanes-Oxley Act was passed in 2002. It is a federal law that covers issues like establishing a public company accounting oversight board, auditory indepedence, corporate responsibility and enhanced finanical disclosure. It is considered one of the biggest changes to the U.S. securities laws since the New Deal. It basically gives additional powers/responsibilities to the U.S. Securities and Exchange Commission(SEC).
Why did this law come about? It came out as a result of the chain of corporate financial scandals, such as Enron, Tyco Internation and MCI (WorldCom). It passed through the House and Senate easily, mostly due tot he public outrage.Search with Enron or Tyco if You need to know more of why this law came about.
The law accounts for the following:
- Financial Reports given must be certified by CEO's and other high ranking corporate entities.
- This is an attempt to make CEO's more responsible and accountable for these reports.
- No Corporate Officer may take out a personal loan using company funds!
- Articles to crack down on insider trading. This includes:
- More reporting on trades made by insiders.
- Inside trades cannot be made during times of pension blackouts.
- Criminal and Civil Penalties for violations of the securities law.
- This includes significantly longer jail senteances/larger fines for corporate executives who knowingly misstate financial statements.
- More Disclosure of financial information.
- Auditing Reforms:
- Auditor Independance: Bans on certain types of work and no longer allow 'pre-ceritification' by an Audit division within a company.
- Audit firms may no longer offer 'extra' services to their clients. These use to include actuarial services, as well as legal services.
- Public Companies must release an annual indendant audit report on their tools used in financial reporting.
The implementation of the new controls have been more than expected. The following table shows the First Year Resources spent on Compliance.
| Company Revenue | $5 B | $5-$10 B | $10-$50 B | >$50 B |
| Average Additional Audit Hours | 6,285 | 20,756 | 11,540 | >19,000 |
| Average Compliance Cost (in millions) | $1.9 | $6.1 | $20.6 | >$1230.3 |
It's easy to see that on paper it seems like it is a great and appropriate action, but it does have its costs. Although most feel that if it prevents another Enron, it'll be worth it.
Links for More Information:
Redwood Software Has Solutions for the Sarbanes-Oxley issue.
The Entire Contents of the Law (Don't hold your breath, the thing is really long.)
Summary of Law by the American Institute of Certified Public Accountants (AICPA)
Back to Computer/Network Security Homepage