by Jason Rohlf – December 22, 2009

"The measure of a man's real character is what he would do
if he knew he would never be found out."

— Thomas Babington Macaulay

I love reading the news because I always learn something new, and it seems to spark previously dormant curiosities in my brain. Today, for example, reading about the Sarbanes-Oxley Act’s various legal and legislative adventures prompted me to research a quote by the 19th Century poet, historian and Whig politician, Thomas Babington Macaulay.

One article that evoked this train of thought was published in the Wall Street Journal, titled “Sarbox Routed in House: A Rare Victory for Small Business.” This piece describes how the U.S. House of Representatives overwhelmingly voted 271–153 for a measure that would exempt the smallest public companies (defined as those with total market capitalization below $75 million) from the heaviest Sarbanes-Oxley auditing regulations. Further solidifying the magnitude of the vote was the bipartisan make-up of the “Yea” voting set—more than 100 Democrats joined Republicans in support of the measure. 

Currently, this provision sits in a larger bill that doesn’t appear to have the support to pass the Senate, but the results of this particular vote speak loudly about the shifting attitudes of our elected officials and their constituency on SOX.  When you also consider that earlier this month the U.S. Supreme Court began hearing arguments on Free Enterprise Fund v. Public Company Accounting Oversight Board, the suit raised against the PCAOB in 2006 challenging the Constitutionality of the Act, most would agree that SOX is facing a great deal of scrutiny. SOX has certainly caused some controversy, particularly when considering the costs associated with achieving compliance and its ability to prevent and detect high-profile cases of corporate malfeasance and neglect. However, it is hard to ignore the fact that the legislation has done a great deal of good in that it has increased organizations’ focus on the effectiveness of their internal control structures.

This is where Mr. Macaulay comes in. I can’t remember where I first heard the quote I reference above, but it has always stuck with me—a perfect marriage of substance and simplicity. What do people do when no one is watching? Do they do the right thing when there is no tangible or tantalizing incentive or threat of punitive action? While a flawed individual (and aren’t we all?), Macaulay is quite articulate in drawing a person’s character into question.

This brought me back to SOX, and I began to think, “What would all of the organizations subject to SOX do if it suddenly went away?” Did I imagine a world where internal controls cease to exist? A place where segregation of duties, system access controls and financial results reviews go the way of the dinosaur and the typewriter? Where legions of workers happily set their password to “password,” never to change it again?

Quite the opposite. Perhaps it’s just the idealist in me, but I believe that the good nature of people on a whole far outweighs the negative forces working against them. And the logical side of me understands that there are proven benefits and incentives associated with implementing and maintaining a sound system of internal controls, among them accurate financial reporting, efficient and effective operations, compliance with laws and regulations, and fraud prevention/detection, not to mention a proven way to help employees understand how their role affects the organization as a whole. Now that organizations have seen the benefit that effective internal controls can bring, I am hard pressed to think that controls will ever fall by the wayside.

I won’t venture to guess whether SOX will be ruled unconstitutional or whether our lawmakers can wrestle their well-supported provision out of a seemingly doomed bill. My guess is that while certain provisions of the Act likely will not change to any significant degree (such as section 302 requiring the CEO and CFO of publicly traded companies to certify their financial statements and internal controls), section 404 may look and feel very different than it is now, and perhaps not long from now. I also believe that leading organizations will continue to efficiently establish, maintain and monitor a strong system of internal controls. It’s the right thing to do, even if no one is watching.