THE SARBANES-OXLEY ACT OF 2002:
WHAT IMPACT HAS IT HAD ON SMALL BUSINESS FIRMS?
Stuart Michelson
Stetson University
421 N. Woodland Blvd, Unit 8398
Deland, Florida 32723
386-822-7376
Fax: 386-822-7446
[email protected]
Jud Stryker
Stetson University
421 N. Woodland Blvd, Unit 8398
Deland, Florida 32723
386-822-7418
[email protected]
Betty Thorne
Stetson University
421 N. Woodland Blvd, Unit 8398
Deland, Florida 32723
386-822-7445
[email protected]
THE SARBANES-OXLEY ACT OF 2002:
WHAT IMPACT HAS IT HAD ON SMALL BUSINESS FIRMS?
Abstract
Purpose
The purpose of this paper is to explore the impact of the Sarbanes-Oxley Act of 2002 (SOX)
on small corporations when compared to large firms and to investigate differences perceived
by small and large firms with respect to costs and internal controls.
Design/methodology/approach
A questionnaire containing 20 questions (five demographic and fifteen addressing issues
related to SOX implementation) was mailed to 5,479 board members, CEOs, and CFOs of
676 separate firms with 117 completed surveys returned.
Findings
The results of the study show significant differences in the responses between small and large
firms concerning 1) the over-all impact of SOX on the firm; 2) the amount of time dedicated
to SOX; 3) the role of the external auditor; the firm’s implementation stage; 4) the most
significant challenges due to SOX implementation; 5) the corporate governance reforms
instituted; and 6) changes in board compensation.
Research limitations/implications
The basic limitation of this study is the low response rate (slightly more than 2%) which is not
surprising since CEOs, CFOs, and Board of Directors have a low tendency to respond to
surveys.
Originality/Value
The findings of this paper suggest that 1) recent actions taken by the Securities and Exchange
Commission (SEC) are appropriate in providing much needed relief for smaller public firms;
and 2) lend support for further actions of assistance by the SEC. This paper is of value to
academicians, practioners, and to an international audience engaged in the harmonization of
accounting standards.
Keywords: Sarbanes-Oxley, SOX, CFO, Board of Directors, Small Firm, Survey
Paper type Research paper
2
THE SARBANES-OXLEY ACT OF 2002:
WHAT IMPACT HAS IT HAD ON SMALL BUSINESS FIRMS?
Introduction
Regulatory Agencies and Congress are recognizing both the values and emerging issues for
small firms as the Sarbanes-Oxley Act of 2002 is implemented. On April 23, 2006 the
Advisory Committee on Smaller Public Companies issued a Final Report to the Security and
Exchange Commission assessing the impact of Sarbanes-Oxley Act of 2002 on smaller public
companies (Securities and Exchange Commission, 2006).
In 2007 the SEC issued non-binding guidelines to aid small firms as they address Sarbanes–
Oxley implementation (Securities and Exchange Commission, 2007). The most significant
concern to smaller firms appears to be the burdensome cost of implementing Section 404 on
internal controls. The Financial Executives Institute (FEI) reports that the highest cost for
each dollar of revenue is that borne by firms with revenue of $100 million or less (3.57%)
(Financial Executives Institute, 2007).
In February 2008 the SEC adopted amendments to its disclosure and reporting requirements
when it issued Smaller Reporting Company Regulatory Relief and Simplification to assist
these smaller firms (Federal Register, 2008). The regulation attempts to more clearly define
smaller public companies and relax disclosure requirements.
In our research we explore the impact of Sarbanes-Oxley Act of 2002 on these smaller firms
when compared to larger firms. We investigate the differences perceived in the small firm
costs, corporate culture, and internal controls. Before addressing these concerns we first
provide some background information to place the study in perspective.
3
Background
Sarbanes-Oxley has focused primarily on reestablishing investor confidence in the financial
markets. The impact on smaller firms has been addressed in few publications. Recent
writings have highlighted steps to aid smaller firms as they struggled with the implementation
of Sarbanes-Oxley. In March 2005 the SEC chartered the Advisory Committee on Smaller
Public Companies to “assess the current regulatory system for smaller companies under the
securities laws of the United States, and make recommendations for changes (Securities and
Exchange Commission, 2006).” In April 2006 this Advisory Committee’s Final Report to the
SEC assessed the impact of Sarbanes-Oxley Act of 2002 on smaller public companies and
included 33 recommendations to the SEC. Primary recommendations included (1)
development of a new system of scaled regulations based on the size of the public company,
(2) exemptive relief from Section 404 for micro-cap and small-cap companies; and (3) scaled
disclosure to these small businesses (Securities and Exchange Commission, 2006).
In this Final Report, the Advisory Committee on Smaller Public Companies expressed their
concern about the costs of SOX implementation: “The Advisory Committee members
generally agree that the costs of SOX are the real issue. The Final Report confirms what we
knew coming into this Committee process, that the costs have exceeded all estimates, and
they hit small companies much more appreciably (Securities and Exchange Commission,
2006).” In this report The Advisory Committee recognized the significant cost and
profitability ramifications for smaller public companies: “Because the costs of Section 404
implementation were underestimated so dramatically (millions of dollars per year, versus
$91,000), the pain and loss of value has been significantly greater for a small company
(Securities and Exchange Commission, 2006).”
In November 2006, Christopher Cox, Chairman of the SEC, said that new auditing standards
are on the way. The goal will be to focus auditor attention on the areas of greatest risk for the
company. Every company will still be subject to an audit but the new standard will translate
to lower audit fees. He also said that the SEC will likely support the size categories proposed
by the Public Accounting Oversight Board (PCAOB). Companies with market capitalization
of under $75 million will be required to evaluate their own internal controls but not to have
4
the results audited. According to the Florida Institute of Certified Public Accountants
(FICPA), annual audits would be introduced in the third year but those audits will probably
focus on the suitability of the design of the internal control though auditors might have to go
beyond those controls in the course of conducting the financial audit (FICPA, 2006a). In
response, the PCAOB issued an exposure draft entitled An Audit of Internal Control That is
Integrated with An Audit of Financial Statements: Guide for Auditors of Smaller Public
Companies (Journal of Accountancy, 2007).
In an SEC press release dated November 15, 2007 it is reported that the SEC voted
unanimously to adopt “measures to modernize and improve its capital-raising, reporting and
disclosure requirements for smaller companies. These measures address some of the key
recommendations made by the SEC's Advisory Committee on Smaller Public Companies in
its Final Report (Securities and Exchange Commission, 2007).” In that same press release the
SEC Chairman, Christopher Cox emphasized the significance of smaller firms:
Smaller businesses are a critical part of our nation's economy…. Although it may
seem that large multinational companies are creating most of the new jobs and
innovation, in fact, small business is leading the way in America's economy. Today's
rule amendments will enable smaller companies to raise capital more effectively and
ease some of the burdens of our reporting and disclosure requirements, and they will
ensure that investors in these companies are paying for important investor protections
and not red tape.
Other research has addressed the harsh realities of implementation costs for both larger and
smaller firms. Marden and Edwards surveyed readers of the journal, Chief Executive. The
primary unknown factor is whether Sarbanes-Oxley's benefits will ultimately outweigh the
significant compliance costs. The Johnson Group, a Chicago consulting firm, estimates
Sarbanes-Oxley will add $3 million to $8 million in annual compliance costs for Fortune 500
companies (Marden and Edwards, 2005). Another study, by the law firm Foley & Lardner,
indicates that medium-size public companies are paying an average of 90% more, or nearly
$2.5 million a year, in compliance costs, compared with $1.3 million before Sarbanes-Oxley
took effect (Marden and Edwards, 2005). According to the FEI just complying with Section
404 of the Act will cost an average of 62% more than previously anticipated (Financial
Executives International, 2007). This increase includes a 109% rise in internal costs, a 42%
5
jump in external costs, and a 40% increase in the fees charged by external auditors (Marden
and Edwards, 2005). The difficulty with trying to determine the costs versus the benefits is
that no one will really know for some time if the new law actually prevents fraud.
The high cost of implementation is a primary factor in small firms delaying full compliance
with Sarbanes Oxley. According to a study performed by the Kauffman-RAND Center for
the Study of Small Business, small companies were disproportionately affected by the
Sarbanes-Oxley Act. The report found that small companies were being purchased by larger
companies at an increased rate of 53%. This appears to be a sign that Sarbanes-Oxley creates
a burden on entrepreneurship, inefficiently forcing companies out of public capital markets
(Insurance Journal, 2006).
Krishnan, Rama and Zhang studied compliance costs and their results indicate that within a
sample of small firms, firm size strongly influences the cost associated with section 404
(Krishnan, Rama and Zhang, 2008).
According to a SOX research study by Lord &Benoit, the “average costs of complying with a
section 404(a) management assessment for all non-accelerated filers included in the study
were $53,724 (ranging from as low as $15,000 to as high as $162,000)…. The range of audit
fee increases was from as low as $7,500 to as high as $86,000 (Journal of Accountancy,
2008).”
Smaller companies may have received multiple extensions for full compliance with SOX but
they don’t appear to be receiving favors when it comes to its costs. "The Cost of Being Public
in the Era of Sarbanes-Oxley," an annual study from Foley & Lardner LLP, reported in 2007
that “the average cost of compliance for companies with under $1 billion in annual revenue
has increased more than $1.7 million to approximately $2.8 million, representing a 171%
overall increase since the adoption of the Sarbanes-Oxley Act (Foley and Lardner, 2007).”
This study also revealed that while internal costs have gone down, on average, external audit
fees have increased 271 percent between fiscal years 2001 and 2006 for firms with under $1
billion in revenue. For public companies with annual revenue under $1 billion this report
6
found that nearly half (47%) of out-of-pocket costs associated with corporate compliance is
associated with audit fees (Foley and Lardner, 2007; Swartz, 2008).
According to a U.S. Survey by SAP America, Inc., almost half of all small companies say that
the Sarbanes Oxley Act has made it more difficult for them to conduct business. The study
reveals that more than two thirds of all small businesses favored different sets of compliance
standards for small and large companies, while others are outsourcing or cutting back in areas
such as marketing ,research, and personnel to meet compliance demands (Swartz, 2006).
Though there seems to be strong evidence that small firms do in fact carry a proportionately
heavier cost burden than larger firms, eventually, they too will be required to comply with
SOX. Crawford, Klamm and Watson believe that eventually small firms will be required to
meet the Sabanes Oxley Act of 2002. They say that small firms will not be able to dodge the
triple threat much longer (Crawford, Klamm and Weidenmier, 2007).
Efforts have been made to accommodate troubled small firms. The SEC has permitted
extensions and supporters have proposed modifications, or exemptions of some sections of the
law for smaller firms. Because of the small firm challenges and the need to gather more
information, the SEC approved a one year extension for small business from auditor
attestation requirements in June of 2008 (Securities and Exchange Commission, 2008).
Board changes are most significant for firms that are targeted by Sarbanes-Oxley and for
firms with large managerial ownership. In addition, director turnover and replacement
increased significantly after the passage of Sarbanes-Oxley. Executive directors are less likely
to be added to the board in the post-Sarbanes-Oxley period than in the pre-Sarbanes-Oxley
period, while non-executive directors are more likely to receive nominations. Linck and Yang
provides evidence that Section 404 resulted in increases in numbers of committees and
committee meetings (Linck and Yang, 2005). There is also strong evidence that SarbanesOxley has imposed disproportionate burdens on small firms. For example, small firms paid
$5.91 to non-employee directors on every $1,000 in sales in the pre-Sarbanes-Oxley period,
which increased to $9.76 on every $1,000 in sales in the post-Sarbanes-Oxley period. In
7
contrast, large firms incurred 13 cents in director cash compensation per $1,000 in sales in the
pre-Sarbanes-Oxley period, which increased only to 15 cents in the post-Sarbanes-Oxley
period (Linck and Yang, 2005).
Each year KPMG’s Audit Committee Institute sponsors two meetings as part of a round table
series to help directors enhance their knowledge and maintain their financial literacy. The
Institute surveys opinions of the directors on important issues during these sessions. Two
issues of importance addressed by the participants were (1) accountability reforms and their
legal exposure; and (2) how management is responding to Section 404 of Sarbanes Oxley.
When asked about their views of the impact of new corporate accountability reforms, over
90% of the 2,550 Fall 2003 attendees felt that the legal obligation/exposure of directors who
served on audit committees had moderately or significantly increased (KPMG, 2003). During
the Spring 2004 session, 2,900 round table participants stated they believe management’s
current approach to Section 404 of Sarbanes-Oxley is having a positive impact on the overall
culture and the “tone at the top.” Seventy-two percent of the respondents said that their
management’s approach is having a “positive” or “very positive” impact on the corporate
culture (KPMG, 2004).
Not everyone agrees with the value of Sarbanes-Oxley. Some believe the costs out-weigh the
benefits while others may have no choice but to adapt. Dalton and Dalton reported that the
number of public companies announcing their intentions to privatize has increased 30% in an
attempt to avoid the Sarbanes-Oxley guidelines (Dalton and Dalton, 2005). However, federal
agencies have started to impose Sarbanes-Oxley provisions on private companies who have
contracts with governmental agencies. These private companies will be expected to adopt
some aspects of SOX. A recent survey of 1,400 private company CFOs indicate that 58%
plan to adopt these guidelines. Dalton and Dalton indicate that private firms may want to
evolve toward Sarbanes-Oxley compliance before they have little or no choice in the matter
(Dalton and Dalton, 2005).
The challenge of complying with Sarbanes-Oxley becomes apparent in a number of studies.
D'Aquila presents a survey of public firms by the professional organization Financial
8
Executives International (D'Aquila, 2004). He reports that audit fees are expected to rise by
about 38 % during the first year of compliance with Section 404. The survey also found that
total costs of first-year compliance with Section 404 could be greater than $4.6 million for
each of the biggest US firms (companies with over $5 billion in revenues).
In 2004 the FEI conducted two surveys of its members to obtain expected estimates of
internal and external time in people hours to comply with Section 404/Management Report on
Internal Controls (Financial Executives International, 2004). FEI determined that the
expected internal costs averaged 12, 265 people hours (ranging from as little as 1,150 people
hours to as much as 35,000 people hours depending on the revenue size of the firm).. From
the FEI respondents it was determined that these companies expected to pay an average of
$732,100 for software, vendor charges, and external consulting. Within approximately a sixmonth period of obtaining these results, the FEI survey its members again and found that
external costs had increased by 41% over the previously expected costs (Financial Executives
International, 2004).
Boury and Spruce present a survey of 224 public companies with average revenues of $2.5
billion (Boury and Spruce, 2005). They report that, on average, companies expect to pay an
estimated $3.14 million in Section 404 compliance costs, with auditors receiving an average
of $823,200 for attestations of internal controls. Another survey (Johnson, 2004) determined
that Section 404 compliance costs would reach $5.1 million for the average US company.
General Electric (Roberts, 2004) has stated publicly that it expected to pay $30 million to
comply with Section 404 in (2004) and the chief executive officer of the New York Stock
Exchange (Morris, 2004) has blamed Section 404 compliance for the reduction in new listings
from European companies on the exchange.
Concerning the amount of time dedicated to achieving their Sarbanes-Oxley objectives, a
survey by PriceWaterhouseCoopers found that 64% of CEOs say that they have dedicated
only a limited amount of time toward this goal while one-third of CEOs say they have
dedicated a great or moderate amount of time and effort. Those active with Sarbanes-Oxley
initiatives do not agree with the potential benefits their company may receive relative to the
9
cost of implementation. Only 5% believe that potential benefits will far exceed the costs of
implementation while 22% see their involvement as a breakeven proposition. In contrast, 43%
feel costs will exceed benefits (PriceWaterhouseCoopers, 2005).
The Manufacturers Alliance/MAPI conducted a survey as a part of their on-going project to
assess the affects of the Sarbanes-Oxley Act of 2002 (Norman, 2006). Senior financial
executives representing forty-three (43) companies shared their perceptions about the cost
impact of Sarbanes-Oxley in the second year of compliance as compared to the first year
costs. Key findings of the survey include:

External auditor’s fees for Section 404 attestation declined by 18% between year one
and year two while the financial audit increased by 3.7%. The total cost of the audit
remains significantly higher than audit fees prior to Sarbanes-Oxley.

The average hourly audit fee for the financial audit fell 9.6%, while the average hourly
audit fee for Section 404 fell 8.7%.

The cost of external non-audit assistance for Section 404 attestation fell by 57.4%,
while the internal audit costs for Sarbanes-Oxley compliance fell by 12.6%.

The over-all average cost of Sarbanes-Oxley compliance declined by 30.2%.

The Audit Committees of most companies in the survey believe that compliance costs
remain high. Just 5% of the respondents indicated their Audit Committee found
compliance costs to be “fair and reasonable” while 41% said the costs are too high.
Some professionals view the unintended consequences of the Sarbanes-Oxley Act of 2002 to
be inappropriate for small entrepreneurial public companies and accounting firms. Bryant
Beckstead, Managing Partner of Beckstead and Watts, LLP, says that recommendations of a
U. S. Securities Exchange Commission Advisory Committee would help ease the current
problems. These recommendations include (FICPA.org, 2006b):

scaled regulations with exemptive relief from internal controls, requirements of SOX,
based on company size,

develop safe-harbor protocol to protect against regulatory actions when processes are
appropriately followed,

exempt smaller audit firms from the PCAOB inspection process and,
10

advise smaller audit firms to advise clients so long as advice is not construed to be
management decision making authority.
There were several issues related to compensation and benefits that were expected to affect
the business world when Sarbanes-Oxley was passed by Congress. Though Sarbanes-Oxley is
still in the implementation stages, it has yet to significantly change the approach to
compensation of either corporate or private firm executives. Directors’ compensation appears
to be on the increase. According to a poll of institutional investors conducted by Oshiki of
Broadgate Consultants LLC, investors believe that transparency surrounding executive
compensation is not sufficient and should be improved (Oshiki, 2005). An overwhelming
majority (83%) of the 105 institutional analysts and portfolio managers from across the US
responding to the survey, say that the new rules relating to auditor testing and certification of
companies’ internal financial controls, required under Section 404 of the Sarbanes-Oxley Act
of 2002, should be modified to make compliance more cost-effective. With studies showing
CEO bonuses at record high levels, nearly two-thirds (61%) of the Oshiki survey respondents
say most companies have not adjusted their compensation policies in response to the claims of
executive excess.
The Sarbanes-Oxley Act of 2002 was enacted primarily to re-establish confidence in the
market and assure investors that financial information fairly represented business firms’
financial status. Though the focus was clearly on the large firms, smaller public companies
were required to implement several parts of the Act as well. Section 404, which addresses
systems and internal controls, requires compliance of small businesses as well as the very
large. Though the Securities and Exchange Commission has permitted the smaller firms
additional time to be in compliance, smaller firms have always been expected to meet the
requirements of SOX. It is important to demonstrate that the impact of SOX on small business
is different than it is on the larger firms. Smaller companies have always had to spend more
of their revenue on compliance than large firms. When SOX was enacted, no cost benefit
analysis was made nor was there any consideration that the impact would be
disproportionately severe on the smaller companies. This paper investigates these differences.
11
The Study
The focus of our research is to explore the impact of the Sarbanes-Oxley Act of 2002 on
smaller corporations when compared to larger firms. We investigate the differences perceived
in the small firm costs, corporate culture, and internal controls. In particular this research
examines if there are statistical differences between the attitudes of respondents from small
firms and the attitudes of respondents from large firms regarding the impact of the SarbanesOxley Act of 2002 on the corporation.
Classification of firms in this study is based on annual revenue. Firms with annual revenue
less than or equal to $250 million are classified as small firms; whereas firms with annual
revenues exceeding $750 million are considered to be large firms. The original survey
instrument for this paper was constructed based on the survey by Michelson-Stryker (2008)
published in Oil, Gas and Energy Quarterly, and includes major questions and issues related
to Sarbanes-Oxley that is found in the literature. The survey was pre-tested on business
school faculty, edited and placed in final form before mailing to potential respondents. These
respondents were selected from a variety of lists of Chief Executive Officers, Chief Financial
Officers, and Board members of large and small firms. The survey instrument contains 20
questions; five are demographic in nature and the remaining fifteen address issues related to
Sarbanes-Oxley implementation (see appendix). A total of 5,479 surveys were sent to board
members, CEOs, and CFOs of 676 separate firms with 117 completed surveys returned. It is
not surprising that the response rate to this survey was only slightly more than 2%, since the
questionnaire was sent to CEOs, CFOs, and Board of Directors who have a low tendency to
respond to surveys. While 2% is low and a limitation of this study, it is still a valid sample for
a study of this type. Standard statistical analysis techniques (such as Pearson’s Chi-Square test
or Fisher’s Exact test) were used to examine the survey responses (Newbold, et al., 2007).
Findings of the Survey
Respondents were asked their opinion about the implementation of the Sarbanes–Oxley
(SOX) Act of 2002. The survey questions addresses topics such as the over-all impact of
SOX on the firm; the impact of SOX on corporate culture; whether the firms instituted new
12
rewards or sanctions related to SOX reporting; the influence of public opinion on
implementation of SOX; whether the firm’s compliance with SOX was an unnecessary
burden; whether the firm’s compliance with SOX has been a necessary cost; whether the
firm’s compliance with SOX would improve the company; the amount of time dedicated to
SOX; potential benefits relative to costs of SOX implementation; legal exposure or obligation
to corporate board; the role of the external auditor; the firm’s implementation stage; areas of
expected improvement due to SOX implementation; most significant challenges due to SOX
implementation; expected process improvements; corporate governance reforms instituted by
the firm’s board related to SOX; and board compensation changes since SOX.
Several differences in the responses from small and large firms were identified as statistically
significant. These differences included respondents’ attitudes about the over-all impact of
SOX on the firm; the amount of time dedicated to SOX; the role of the external auditor; the
firm’s implementation stage; the most significant challenges due to SOX implementation; the
corporate governance reforms instituted; and changes in board compensation. Table 1 lists
the statistically significant hypotheses related to our survey questions along with
corresponding p-values. (See Table 3 for other hypotheses and corresponding p-values
developed from our survey questions).
Table 1: Significant Attitude Differences Between Small and Large Firms Towards SarbanesOxley
Survey
Hypotheses Related to Survey Questions
Question
Number
There is a difference between the attitudes of respondents from
6
small firms and attitudes of respondents from large firms about the
overall impact of Sarbanes-Oxley on the firm.
p-value
0.006
11
There is a difference between the attitudes of respondents from small
firms and attitudes of respondents from large firms about the time
dedicated to Sarbanes-Oxley.
0.001
14
There is a difference between the attitudes of respondents from small
firms and attitudes of respondents from large firms about the role of the
external auditor.
0.014
13
15
Large and small firms are not equally likely to be in the same
completion stage in implementing Sarbanes-Oxley.
0.036
17
Small firms and large firms are not equally likely to consider cost
of the project and its efficiency as one of the most significant
challenges due to Sarbanes-Oxley implementation.
0.004
19
Instituting corporate governance reforms concerning
CEO/CFO financial statement certification is dependent of the
size of the firm.
0.032
20
Small firms and large firms are not equally likely to have
increased board compensation since Sarbanes-Oxley. An
increase in board compensation is dependent of the size of the firm.
0.001
General Statistical Data
Table 2 presents the percent of respondents to each survey question for small firms, for large
firms, and for the total number of firms in our study. All large firms in our study were public
firms. The composition of small firms varied. Public firms accounted for only 65.6% of the
small firms with 18.8% representing private firms, and the remaining 15.6% were not-for
profit small firms. From the total number of companies surveyed most respondents were
members of the firms’ board of directors (41%), with 23.3% being CEOs and 39.7% were
CFOs. Note that there is overlap in these numbers because a respondent can be both a member
of the board of directors and also a CEO or CFO. When annual revenue is considered, only
31.3% of respondents from small firms versus 55.2% of respondents from large firms were
members of the board of directors; CEO’s comprised one-fourth of small firm respondents
compared to only 10.3% of the large firm respondents.
When classified by annual revenue, smaller firms represented approximately 27.4% of the
sample, the mid-range was 47.0% and the large firms accounted for 24.8%. There was
considerable variation in number of employees, with a maximum of 140,000 employees in
large firms compared to a maximum of only 2300 in small firms. The minimum number of
employees in a small firm was seven employees whereas the minimum number of employees
14
in a large firm was 1,100 employees. The median number of employees in the smaller firms
was 510 significantly less than the median of 6,000 employees in larger firms. On average a
firm’s internal audit staff remain small (1.2 for small firms; 6.29 for large firms) with a
maximum of only six people for smaller firms.
Overall Impact of Sarbanes-Oxley
One area of interest was the respondent’s perception of the overall impact of Sarbanes-Oxley
on the firm and its corporate culture. Nearly 80% of large firm respondents felt SarbanesOxley had a major or very major impact on their firms. This figure was significantly less for
small firms with annual revenue not exceeding $250 million. For this group, only 43.3% felt
that the Sarbanes-Oxley had a major or very major impact on their firms. Approximately the
same percent of small firm respondents expressed their opinion that SOX had a minor or very
minor impact. Although opinions varied as to the impact of Sarbanes-Oxley on corporate
culture, data was insignificant to conclude that these opinions varied by size of the firm.
Nearly 40% of large and small firms felt Sarbanes-Oxley created a positive or very positive
impact on their firms, while approximately one-fourth of these firms felt there was a negative
or very negative impact on their corporate culture. This is consistent with the KPMG Audit
Committee round table survey which suggests that Sarbanes-Oxley is having a positive
impact on the overall culture and “the tone at the top” (KPMG, 2004).
Rewards and Sanctions
An important issue is whether respondents initiated any rewards or sanctions as the result of
SOX. Survey results suggest that most firms have instituted neither rewards nor sanctions
related to Sarbanes-Oxley reporting (75%). Slightly more than 10% of all firms have
instituted rewards and 17.20% have instituted sanctions related to unethical behavior or poor
performance on SOX activities. No significant interaction was found (p-value = 0.411)
between the size of the firm and instituting rewards related to positive performance on
Sarbanes-Oxley reporting. The majority of firms believe that public opinion has had no
influence on Sarbanes-Oxley (62.90%). Also, the survey data was not statistically significant
15
to conclude that opinions about the influence of public opinion resulting from the
implementation of Sarbanes-Oxley were dependent on the size of the firm (p-value = 0.241).
Compliance Issues
Another area of interest is compliance with the law. Two specific issues were (1) the role of
the external auditor and (2) at what stage of the implementation process were the firms at the
time of our survey. We found that the role of the external auditor varies from firm to firm.
Most (43.4%) external auditors counsel and advise during the process, while 32.7% of
external auditors provide no help until the external audit is performed. Fewer (13.3%) external
auditors provide repository tools and facilitates throughout the compliance process. Nearly
90% of firms with annual revenues above $750 million considered the role of the external
auditor as being helpful during the compliance process. A much smaller percent (61.3%) of
firms with annual revenues at $250 million or less held this opinion.
Other studies suggest that most external auditors no longer concurrently perform non-audit
functions for the audited firm. Protiviti found that eighty-three percent (83%) of the large
companies had adopted procedures governing non-audit services by their external auditors
(Protiviti, 2003). Thirteen percent (13%) of these companies prohibit all non-audit services by
external auditors. Sixty-three percent (63%) have rules that parallel SEC regulations
regarding non-audit services external auditors can provide. They also require that all nonaudit services provided by external auditors be approved in advance.
This suggests that the
larger companies in the Protiviti study had modified their procedures to comply with the SEC
independence rules issued in 2003.
Over three-fourths of firms (76.1%) in our study indicate that they are in complete compliance
with Sarbanes-Oxley, while the remaining firms state that they are in a combination of the
stages of the process (assessment, remediation, testing, and/or documentation). Small firms
(62.1%) are less likely than large firms (86.2%) to have completed the implementation of
Sarbanes-Oxley (p-value = 0.036).
16
Cost Benefit
A key topic addressed in the study is the perceived costs and benefits resulting with the
implementation of SOX. Most firms (53.2%) reveal that Sarbanes-Oxley has been an
unnecessary burden, while 27% indicate that it has been a necessary cost, and 19.8% feel it
will improve their company. These figures vary slightly if annual revenue of the firm is
considered. Nearly 59% of small firms indicated that Sarbanes-Oxley was an unnecessary
burden; whereas this opinion was held by only 44.8% of large firms. Only 20.7% of small
firms considered Sarbanes-Oxley to be a necessary cost whereas 31% of large firms held this
view. Both small (77.4%) and large firms (86.2%) indicate that Sarbanes-Oxley costs will
exceed its benefits. These findings are similar to the 2007 FEI survey, which indicates 78.1%
of firms state that costs exceed the benefits of compliance with Section 404 (Financial
Executives International, 2007). This result is much higher than the PriceWaterhouseCoopers
survey which indicates that 43% of CEOs believe that costs will exceed benefits
(PriceWaterhouseCoopers, 2005). No significant interaction was found (p-value = 0.379)
between the firms’ attitude about the cost/benefits of Sarbanes-Oxley and the size of the firm
measured by annual revenue.
At the same time, most firms (58.7%) state that they dedicate a large amount of time or a very
large amount of time to Sarbanes-Oxley. These findings are consistent with a 2004 FEI study
which states that audit fees are expected to rise by about 38 % during the first year of
compliance with Section 404 (Financial Executives International, 2004). It is not surprising
that a significant interaction was found (p-value = 0.001) when considering the amount of
time to implement Sarbanes-Oxley and the size of the firm. Large firms are more likely to
dedicate a large amount of time (72.4%) than small firms (31.3%).
The 2007 FEI survey also finds that total costs of first-year compliance with Section 404
could be greater than $4.6 million for each of the biggest US firms (companies with over $5
billion in revenues). Even though the findings indicate that executives feel that the costs of
Sarbanes-Oxley outweigh the benefits, the 2007 FEI Survey finds that 45.6% of firms agree
that financial reports are more accurate and 48.1% of firms agree that financial reports are
17
more reliable (Financial Executives International, 2007). So, while firms believe the costs are
high, they tend to express more confidence in the value of Section 404.
Improvements, Challenges and Remunerations:
Our study finds that firms expect to make improvements in a number of areas due to
implementing Sarbanes-Oxley. The number one area of expected improvements for all firms
was in control documentation and testing with 46.9% of small firms and 69% of large firms
indicating this expectation. Among small firms internal audit tied for top area of expected
improvements (46.9%) whereas this area ranked fourth by large firms (37.9%). The next area
small firms (43.8%) indicated for expected improvement is IT (security, strategy and
implementation, oversight operations). Risk identification and assessment ranked second
among large firms (55.2%) and tied for third rank among expected areas of improvements for
small firms (40.6%). It’s interesting that both small and large firms indicated that
improvements in risk mitigation processes and strengthening the code of conduct/ethics as the
least mentioned areas for improvement. The lack of interest in the corporate code of
conduct/ethics is borne out by Bernardi and LaCrosse who found that none of the former
Anderson clients post their code of ethics on their corporate websites. Deloitte & Touche find
that only 52% of 4,000 publicly traded firms distribute their codes to stakeholders (Bernardi
and LaCrosse, 2005).
Firms had a number of significant challenges due to Sarbanes-Oxley implementation.
Insufficient resources and/or time constraints was the number one challenge for small firms
(54.8%) and the number two challenge for large firms (48.3%). For most of the challenges, no
significant differences in the responses were identified between large and small firms.
However, one area stood out – that of cost of the project and its efficiency. A significant
interaction was found between the challenge of cost of the project and its efficiency with the
size of the firm (p-value = 0.004). Large firms (82.8%) are more likely to regard cost of the
project and its efficiency to be a significant challenge due to Sarbanes-Oxley than small firms
(46.9%). These major challenges were followed by: lack of definitive standards (25% of
small firms; 31% of large firms); documentation issues (21.9% of small firms; 41.4% of large
18
firms); and lack of sufficient guidance from external auditors (21.9% of small firms; 31% of
large firms). Controls identification and testing (3.0%) was the least frequent mentioned
challenge by small firms. The IIA (2004) survey finds that there are a number of challenges to
implementing Sarbanes-Oxley, including not enough resources, time constraints and
documentation issues.
Although no significant interactions between areas in which firms expect remediation efforts
to comply with Sarbanes-Oxley and the size of the firm were identified, nonetheless some
interesting findings arise from this study. IT controls is the primary area in which all firms
regardless of annual revenue expect remediation efforts to comply with Sarbanes-Oxley. Both
small firms (50%) and large firms (55.2%) indicated this as the top issue for expected
remediation. Financial process improvements was ranked second by small firms (37.5%) and
tied for second with internal audit effectiveness by large firms (37.9%). Only one-fourth of
small firm respondents listed internal audit effectiveness as an area of expected remediation
efforts to comply with Sarbanes-Oxley. Once again, it’s interesting that audit committee
oversight and fraud programs were the least frequently mentioned. Only 6.3% of small firms
and 6.9% of large firms expected process improvements concerning fraud programs.
Governance and Board Compensation and Reforms
Corporate governance is an important issue under Sarbanes-Oxley. Boards have instituted a
number of reforms due to the Act of 2002. As expected, CEO/CFO financial statement
certification (70.4%) is the primary reform relating to Sarbanes-Oxley. Other areas that are
still major priorities include: corporate governance policy guidelines (49.6%), board approval
of non-audit services (50%), and establishment of whistle-blower policies (56.9%). These
areas are followed by additional review of financial statements by the board and/or audit
committee (38.8%). The Protiviti survey reports that CFOs are highly engaged in SarbanesOxley implementation and that board of directors are now conducting self assessments
(Protiviti, 2003). Our study did not show any significant relationships between the size of the
firm and these series of options, with the exception of the CEO/CFO financial statement
certification where a significant interaction was found (p-value = 0.032). Large firms (79.3%)
19
are more likely than small firms (53.1%) to institute corporate governance reforms concerning
the CEO/CFO financial statement certification.
Interestingly, firms don’t believe that their corporate board’s legal exposure or obligation has
increased much due to Sarbanes-Oxley. Of those surveyed, 38.3% indicate that legal exposure
has increased moderately, 14.8% replied that the legal exposure had increased significantly
and 40% indicate that there has been no change in legal exposure. This is in contrast to the
(KPMG, 2003) Round Table which reported that over 90% of audit committee participants
indicated that legal obligation/exposure has moderately or significantly increased. When the
data from our studied was stratified by annual revenue, small firms (43.8%) were less likely
than large firms (62%) to believe that the Board’s legal exposure or obligation had increased
since the implementation of Sarbanes-Oxley.
Our survey results reflecting changes in board compensation are mixed. The firms in our
study indicate that compensation has increased (65.2%), retainer has increased (34.8%), cash
compensation has increased (40.5%), equity compensation has increased (21.4%), and the
audit committee has received increased compensation (21.6%). Additionally, committee
chairs have received increased compensation in19% of the responses. The National
Association of Corporate Directors (NACD) survey is consistent with these results and
observes that director cash compensation has increased significantly, although equity
compensation has decreased (National Association of Corporate Directors, 2004). The NACD
survey also reports that retainers are common components of compensation and are related to
firm size and that additional compensation is being awarded to committee chairs.
In our study, a significant interaction was found between the size of the firm and an increase
in board compensation (p-value = 0.001). Small firms (38.7%) are less likely than large firms
(82.8%) to increase board compensation since Sarbanes-Oxley. However, this study did not
show significant differences between the size of the firm and other board compensation
changes such as an increase in retainer (p-value = 0.605), increase in cash compensations (pvalue = 0.724), increase in equity compensation (p-value = 0.849), or an increase in audit
committee compensation (p-value = 0.174).
20
Conclusions
Neither Paul Sarbanes nor Michael Oxley could have foreseen the changes their 2002 Act
would have on corporate America. Its impact has been profound. Respondents in our study
say that SOX has, or will have, a major impact on their business activities. To date, the most
pronounced changes have taken place in larger firms, but smaller firms are feeling its
influence as well. To no one’s surprise the greatest concern to these firms was cost. Our study
confirms the findings of previous studies and also supports the calls to the SEC and Congress
for relief for smaller firms. When asked the most significant challenge due to Sarbanes-Oxley
implementation, over 80% of large firms identified cost as the primary concern. Small firm
participants said that insufficient resources and time constraints were the primary issue,
closely followed by costs of the project.
At the time of our study, large firms were much closer to full implementation because of the
availability of resources and time to complete the SOX requirements. Large firms had
devoted extensive time while small firms lagged significantly behind in the process. We also
found that small firms had devoted significantly less effort to instituting CEO/CFO financial
certification than had the larger firms.
It appears that both large and small firms are making progress in establishing corporate
governance policy guidelines, establishing whistle blowing policies, and securing Board
approval of non-audit services by auditors. Information from our study also suggests that
larger firms were more likely to use the counsel and advice of the external auditor during the
implementation process. This may be partially explained by the fact that the larger firms are
closer to completion of the process than the smaller firms. With the increased potential of
liability and greater demand on Board members’ time, increased compensation for these
Board members could be anticipated. We found this to be true and that compensation
increases and audit committee increases were more pronounced in the larger firms than in the
smaller firms.
21
Our study supports prior research that confirms costs and insufficient resources as the most
significant challenges in the implementation of Sarbanes-Oxley. In addition we point out
significant differences in the views of small and large firm respondents concerning the impact
of SOX on their firms. Our findings suggest that recent actions taken by the SEC are
appropriate in providing much needed relief for smaller public firms. The SEC’s Office of
Economic Analysis (OEA) is conducting currently a web-based survey which is “an integral
part of the Commission’s cost-benefit study related to the implementation of Section 404 of
the Sarbanes-Oxley Act of 2002 (Protiviti, 2008).” The SEC considers this survey to be “a
mechanism to help ensure that smaller companies do not bear a disproportionably high cost of
compliance relative to the costs incurred by larger filers (Protiviti, 2008).” These SEC
findings are expected to be released sometime in 2009 (Protiviti, 2008). A survey such as
this validates the significance of this paper.
Clearly, there is room for further research related to the impact that Sarbanes-Oxley on
corporate America. It might be of interest to replicate our survey at a future point in time to
compare changes. Investigating the impact of SOX on different industries could be revealing.
It may be worthwhile to compare the views of professional groups such as bankers, auditors,
government officials, CEOs, CFOs, as well as those who serve on the Board of Directors.
These professionals may provide interesting perspectives and offer fertile grounds for
additional research. Much has been and will be written about the far reaching effects of the
Sarbanes-Oxley Act of 2002. One thing is certain; the landscape of corporate America will be
forever changed because of the Sarbanes Oxley Act of 2002.
BIBLIOGRAPHY
Bernardi, R. A. and LaCross, C. C. (2005), “Corporate Transparency: Code of Ethics
Disclosures”, The CPA Journal, Vol. 75 Issue 4, pp. 34-37.
Boury, P. M. and Spruce, C. M. (2005), “Auditors at the Gate: Section 404 of The
Sarbanes-Oxley Act and The Increased Role of Auditors in Corporate Governance”,
International Journal of Disclosure and Governance, Vol. 2 Issue 1, pp. 27-51.
Crawford, W., Klamm, B. and Watson Weidenmier, M. (2007), “Surviving Three SOX
Opinions”, Strategic Finance, Vol. 88 Issue 11; pp. 47 -52.
22
D'Aquila, J. M., (2004), “Tallying the Cost of the Sarbanes-Oxley Act”, CPA Journal,
Vol. 74 Issue 11, pp 6, 8-9.
Dalton, D.R. and Dalton, C. M. (2005), “Sarbanes-Oxley Legislation and The Private
Company: If not a Marriage, Then Certainly an Engagement”, The Journal of Business
Strategy, Vol. 26 Issue 2, p. 7- 8.
Federal Register (2008), Smaller Reporting Company Regulatory Relief and Simplification.
Volume 73, Number 3, 4 January [Rules and Regulations] pp. 933-983, available
at: www.sec.gov/rules/final/2007/33-8876.pdf (accessed 10 February 2009).
FICPA.org, (2006a), “Cox Says Changes on the Way”, New York Times interview with
Securities and Exchange Commission Chairman, Christopher Cox, 10 November,
available at: www.ficpa.org (accessed 13 March 2007).
FICPA.org, (2006b), “Sarbanes-Oxley: The Impact on Smaller Firms”, 13 November,
available at: www.ficpa.org (accessed 13 March 2007).
Financial Executives International (2004) “FEI Special Survey on Sarbanes Oxley Section
404 Implementation Executive Summary”, July, available at:
www.404institute.com/docs/SOXSurveyJuly.pdf, (accessed 09 February 2009).
Financial Executives International (2007) “FEI Special Survey on Sarbanes Oxley, Section
404 Implementation Executive Summary”, May, available at:
www.financialexecutives.org (accessed 09 February 2009).
Foley & Lardner, LLP (2006), “The Cost of Being Public in the Era of Sarbanes-Oxley”,
available at: www.foley.com (accessed 10 February 2009).
Insurance Journal (2006), Rand Study: Small Public Firms Felt Effects of Sarbanes-Oxley 13
June, available at: www.insurancejournal.com/news/national/2006/06/13/69429.htm,
(accessed 09 February 2009).
Johnson, C. (2004), “Audit Compliance Deadline Proves Costly to Companies”, Washington
Post, 15 November, p. A14.
Journal of Accountancy (2007), Exposure Drafts Outstanding, December, Vol. 204, Issue 6,
p.90 –2.
Journal of Accountancy (2008), “Spending on SOX”, New York: April, Vol. 205, Issue 4;
p.19.
KPMG Audit Committee (2003), Round Table Highlights, Fall, p. 12.
KPMG Audit Committee Institute (2004), Oversight of Auditors, Audit Committee Round
Table Highlights, Spring, p. 18.
23
Krishnan, J., Rama, D., and Zhang, Y. (2008), “Cost to Comply with SOX Section 404”,
Auditing: A Journal of Practice and Theory, Vol. 27, No. 1, May 2008, pp. 169-186.
Linck, J., Netter, J. and Yang, T. (2005), “Effects and Unintended Consequences of SarbanesOxley on Corporate Boards”, University of Georgia working papers.
Marden, R,. Edwards, R. (2005), “The Sarbanes-Oxley 'Ax'”, CPA Journal. Vol.75,
Issue 4, pp. 6-9.
Michaelson, S., Stryker, J. (2008), “A Comprehensive Survey of the Impact of the SarbanesOxley Act of 2002”, Oil, Gas and Energy Quarterly, October. 57(1), pp. 155-174.
Morris, F. (2004), ”US and European Securities Officials Vow Cooperation”,
New York Times, 5 June, p 3.
National Association of Corporate Directors (2004), “2003-2004 Director Compensation
Survey”, available at: https://secure.nacdonline.org/source/meetings/presslistdetail.cfm?pressID=28 (accessed 09 February 2009).
Newbold, P., Carlson, W. L. and Thorne, B.(2007), Statistics for Business and Economics,
Prentice-Hall, Upper Saddle River, NJ.
Norman, D. A. (2006), “The Cost of SOX and the Compliance Process: Year 2”,
Manufacturers Alliance/MAPI Survey.
Oshiki, A. (2005), Broadgate Consultants, LLC, “High Compliance Costs Outweigh Benefits
Say Investors”, March, PR Newswire.
PricewaterhouseCoopers (2005), “30% of Fast-Growth Private Companies Applying
Sarbanes-Oxley Principles”, available at: www.barometersurveys.com
(accessed 10 February 2009).
Protiviti Inc. (2003), “Insights on Today's Sarbanes-Oxley and Corporate Governance
Challenges”, 13 September, available at: www.protiviti.com (accessed 10 February
2009).
Protiviti, Inc. (2008), “SEC Commences Survey Regarding Costs and Benefits of Section 404
Compliance”, 18 December, available at: www.protiviti.com (accessed 10 February
2009).
Roberts, D. (2004), “GE says it faces dollars 30m bill for governance”, Financial Times, 29
April, p.15.
Securities and Exchange Commission (2006) - Final Report of the Advisory Committee on
Smaller Public Companies to the U.S. Securities and Exchange Commission, April 23,
24
2006, available at: www.sec.gov/info/smallbus/acspc/acspc-finalreport.pdf (accessed
04 March 2008).
Securities and Exchange Commission (2007), SEC Votes to Adopt Three Rules to Improve
Regulation of Smaller Businesses, Washington, D.C., 15 November, available at:
www.sec.gov/news/press/2007/2007-233.htm (accessed 04 March 2008).
Securities and Exchange Commission (2008), SEC Approves One-Year Extension for Small
Businesses From Auditor Attestation Requirement in Sarbanes-Oxley Act, available at
www.sec.gov/news/press/2008/2008-116.htm (accessed 02 February 2009).
Swartz, N. (2006), “Small Firms Seek Different SOX Rules”, Information Management
Journal, Jan/Feb2006, Vol. 40 Issue 1, pp. 6-7.
Swartz, N. (2008), “SOX Costs Socks Small Firms”, Information Management Journal,
Mar/Apr2008, Vol. 42 Issue 2, p.14.
25
TABLE 2
Sarbanes-Oxley Survey Responses
1
2
3
4
5
6
7
Large
Firms
Small
Firms
All
Firms
Annual Revenues
Less than $100 million
$101 million to $250 million
$251 million to $500 million
$501 million to $750 million
$751 million to $1 billion
Over $1 billion
0.00%
0.00%
0.00%
0.00%
58.60%
41.40%
43.80%
56.30%
0.00%
0.00%
0.00%
0.00%
12.00%
15.40%
30.80%
16.20%
14.50%
10.30%
Number of Employees
(1) Mean
(2) Median
(3) SD
(4) Min
(5) Max
13,016
6,000
26,066
1,100
140,000
571.78
510
544.531
7
2300
4,663
1,300
14,115
7
140,000
6.29
4.00
8.40
0
35
1.20
1.00
1.472
0
6
3.79
2
5.56
0
35
100.00%
0.00%
0.00%
65.60%
18.80%
15.60%
90.50%
5.20%
4.30%
Position with Firm
Member of Board of Directors
CEO
CFO
Other
55.20%
10.30%
34.50%
3.40%
31.30%
25.00%
46.90%
12.50%
41%
23.30%
39.70%
9.50%
Over-all Impact of Sarbanes-Oxley on firm
Very minor
Minor
Neither minor nor major
Major
Very major
7.10%
3.60%
10.70%
75.00%
3.60%
16.70%
23.30%
16.70%
33.30%
10.00%
7.10%
11.60%
13.40%
61.60%
6.30%
Impact of Sarbanes-Oxley on Corporate Culture
Very positive impact
Positive impact
No impact
Negative impact
Very negative impact
0.00%
37.90%
34.50%
27.60%
0.00%
3.10%
34.40%
37.50%
18.80%
6.30%
1.70%
36.50%
30.40%
26.10%
5.20%
Number of People on Internal Audit Staff
Mean
Median
SD
Min
Max
Type of Company
Public
Private
Not-for-profit
26
8
9
10
11
12
13
14
Large
Firms
Small
Firms
All
Firms
13.80%
6.30%
12.10%
24.10%
72.40%
15.60%
81.30%
17.20%
75.00%
How much influence has public opinion had on Implementation
of Sarbanes-Oxley?
Very minor
Minor
No influence
Major
Very major
3.40%
34.50%
44.80%
13.80%
3.40%
6.30%
18.80%
68.80%
6.30%
0.00%
10.30%
18.10%
62.90%
7.80%
0.90%
Firm's compliance with Sarbanes-Oxley has been:
An unnecessary burden
A necessary cost
Will improve our company
44.80%
31.00%
24.10%
58.60%
20.70%
20.70%
53.20%
27.00%
19.80%
Time dedicated to Sarbanes-Oxley
Very limited amount of time
Limited amount of time
Moderate amount of time
Large amount of time
Very large amount of time
0.00%
10.30%
17.20%
55.20%
17.20%
21.90%
6.30%
40.60%
21.90%
9.40%
6.00%
4.30%
31.00%
37.10%
21.60%
Potential Benefits Relative to costs of implementing SarbanesOxley
Benefits exceed costs
Breakeven
Costs exceed benefits
3.40%
10.30%
86.20%
12.90%
9.70%
77.40%
6.10%
7.00%
87.00%
Corporate Board's legal exposure or obligation
Increased significantly
Increased moderately
No change in legal exposure
Decreased moderately
Decreased significantly
10.30%
51.70%
34.50%
0.00%
3.40%
12.50%
31.30%
43.80%
12.50%
0.00%
14.80%
38.30%
40.00%
6.10%
0.90%
Role of External Auditor
Provides repository tools and facilitates throughout the compliance
process
Counsel and advise during the process
No help until the external audit is performed
Other
21.40%
53.60%
10.70%
14.30%
12.90%
38.70%
38.70%
9.70%
13.30%
43.40%
32.70%
10.60%
Firm Instituted new rewards or sanctions related to SarbanesOxley reporting
Yes, rewards related to positive performance on SOX reporting
Yes, sanctions related to unethical behavior or poor performance on
SOX activities
Neither
27
15
16
17
18
19
Large
Firms
Small
Firms
All
Firms
Stage in the Sarbanes-Oxley process
Complete compliance
Assessment
Remediation
Testing
Documentation
Combination of the above
Other
86.20%
0.00%
3.40%
3.40%
0.00%
6.90%
0.00%
62.10%
0.00%
0.00%
0.00%
6.90%
17.20%
13.80%
76.10%
0.90%
3.50%
0.90%
1.80%
12.40%
4.40%
Due to implementing Sarbanes-Oxley, firm expects to make
improvements in:
Risk identification and assessment
Financial reporting
Internal audit
Compliance management
IT (security, strategy and implementation, oversight operations)
Risk mitigation processes
Control documentation and testing
Updating governance procedures
Strengthening code of conduct/ethics
Updating or adding "whistleblower" policies
Other
55.20%
31.00%
37.90%
27.60%
48.30%
20.70%
69.00%
20.70%
20.70%
34.50%
10.30%
40.60%
25.00%
46.90%
40.60%
43.80%
15.60%
46.90%
28.10%
21.90%
31.30%
9.40%
41.40%
30.20%
45.70%
37.10%
45.70%
22.40%
62.10%
25.00%
19.80%
31.00%
8.60%
Most significant challenges due to SOX implementation
Insufficient resources and/or time constraints
Documentation issues
Lack of definitive standards
Size or complexity of our organization
Lack of sufficient guidance from external auditors
Controls identification and testing
Cost of the project/efficiency
Other
48.30%
41.40%
31.00%
10.70%
31.00%
13.80%
82.80%
6.90%
54.80%
21.90%
25.00%
6.30%
21.90%
3.10%
46.90%
9.40%
61.70%
32.80%
35.30%
13.90%
34.50%
12.10%
67.20%
7.80%
Areas in which you expect remediation efforts (process
improvements) to comply with Sarbanes-Oxley
Security controls
IT controls
Financial process improvements
Audit committee oversight
Fraud programs
Internal audit effectiveness
Other
24.10%
55.20%
37.90%
17.20%
6.90%
37.90%
10.30%
21.90%
50.00%
37.50%
15.60%
6.30%
25.00%
9.40%
20.90%
50.00%
36.00%
18.10%
4.30%
28.40%
8.60%
Corporate Governance reforms Board instituted related to SOX
Corporate governance policy guidelines
Board approval of non-audit services by company auditors
Establishment of whistle-blower policies
CEO/CFO financial statement certification
50.00%
51.70%
44.80%
79.30%
46.90%
43.80%
59.40%
53.10%
49.60%
50.00%
56.90%
70.40%
28
Additional reviews of financial statements by the Board and/or Audit
Committee
Other
20
Board compensation changed since Sarbanes-Oxley
Compensation has increased
Retainer has increased
Cash compensation has increased
Equity compensation has increased
Audit Committee have received increased compensation
Committee Chairs have received increased compensation
Other
29
37.90%
6.90%
34.40%
9.40%
38.80%
6.10%
Large
Firms
Small
Firms
All
Firms
82.80%
27.60%
24.10%
20.70%
48.30%
17.20%
13.80%
38.70%
21.90%
28.10%
18.80%
31.30%
18.80%
40.60%
65.20%
34.80%
40.50%
21.60%
54.30%
19.00%
19.00%
TABLE 3
Hypotheses Related to Survey Questions
Survey
Question
Number
6
p-value
There is a difference between the attitudes of respondents from small firms
and attitudes of respondents from large firms about the overall impact of
Sarbanes-Oxley on the firm.
0.006
7
Small firms and large firms have different attitudes about the impact of SarbanesOxley on the firm’s corporate culture.
0.972
8.1
There is a relationship between the size of the firm and whether the firm
instituted new rewards related to positive performance on SOX reporting.
Instituting rewards related to positive performance on SOX reporting is
dependent on the size of the firm.
0.411
8.2
There is a relationship between the size of the firm and whether the firm
instituted new sanctions related to unethical behavior or poor performance
on SOX activities. The decision to institute new sanctions related to
unethical behavior or poor performance on SOX activities is independent of
the size of the firm.
0.404
8.3
There is a relationship between the size of the firm and whether the firm
did not institute both new rewards and new sanctions related to unethical
behavior or poor performance on SOX activities.
0.412
9
There is a difference between the attitudes of respondents from small firms
and attitudes of respondents from large firms about influence of public
opinion resulting from the implementation of Sarbanes-Oxley.
0.241
10
There is a difference between the attitudes of respondents from small firms
and attitudes of respondents from large firms about the value of firm’s
compliance with Sarbanes-Oxley.
0.546
11
There is a difference between the attitudes of respondents from small firms and
attitudes of respondents from large firms about the time dedicated to SarbanesOxley.
0.001
12
There is a difference between the attitudes of respondents from small firms
and attitudes of respondents from large firms about the cost/benefits of
implementing Sarbanes-Oxley.
0.379
13
There is a difference between the attitudes of respondents from small firms
and attitudes of respondents from large firms about the Board’s legal
exposure or obligation
0.152
30
14
There is a difference between the attitudes of respondents from small firms and
attitudes of respondents from large firms about the role of the external auditor.
0.014
15
Large and small firms are not equally likely to be in the completion stage in
implementing Sarbanes-Oxley.
0.036
16.1
There is a difference between the attitudes of respondents from small firms
and attitudes of respondents from large firms about the improvements
expected to be made by the firm in risk identification and assessment.
0.256
16.2
There is a difference between the attitudes of respondents from small firms
and attitudes of respondents from large firms about the improvements
expected to be made by the firm in financial reporting.
0.600
16.3
There is a difference between the attitudes of respondents from small firms
and attitudes of respondents from large firms about the improvements
expected to be made by the firm in Internal Audit
0.481
16.4
There is a difference between the attitudes of respondents from small firms
and attitudes of respondents from large firms about the improvements
expected to be made by the firm in Compliance management.
0.284
16.5
There is a difference between the attitudes of respondents from small firms
and attitudes of respondents from large firms about the improvements
expected to be made by the firm in IT(security, strategy & implementation,
oversight, operations).
0.723
16.6
There is a difference between the attitudes of respondents from small firms
and attitudes of respondents from large firms about the improvements
expected to be made by the firm in risk mitigation processes.
0.607
16.7
There is a difference between the attitudes of respondents from small firms
and attitudes of respondents from large firms about the improvements
expected to be made by the firm in control documentation and testing.
0.081
16.8
There is a difference between the attitudes of respondents from small firms
and attitudes of respondents from large firms about the improvements
expected to be made by the firm in updating governance procedures
0.501
16.9
There is a difference between the attitudes of respondents from small firms
and attitudes of respondents from large firms about the improvements
expected to be made by the firm in strengthening code of conduct/ethics.
0.910
16.10
There is a difference between the attitudes of respondents from small firms
and large firms about the improvements expected to be made by the firm in
updating or adding “whistleblower” policies.
0.788
31
16.11
There is a difference between the attitudes of respondents from small firms
and attitudes of respondents from large firms about the improvements
expected to be made by the firm in other areas
1.00
17.1
Small firms and large firms are not equally likely to consider insufficient
resources and/or time constraints as one of the most significant challenges
due to SOX implementation. A firm’s opinion whether insufficient
resources and/or time constraints is one of the most significant challenges
due to SOX implementation depends on the size of the firm.
0.611
17.2
Small firms and large firms are not equally likely to consider
documentation issues as one of the most significant challenges due to SOX
implementation. A firm’s opinion whether documentation issues is one of
the most significant challenges due to SOX implementation depends on the
size of the firm
0.100
17.3
Small firms and large firms are not equally likely to consider a lack of
definitive standards as one of the most significant challenges due to SOX
implementation. A firm’s opinion whether a lack of definitive standards is
one of the most significant challenges due to SOX implementation depends
on the size of the firm.
0.600
17.4
Small firms and large firms are not equally likely to consider their size or
complexity of their organization as one of the most significant challenges
due to SOX implementation. A firm’s opinion whether their size or
complexity of their organization is one of the most significant challenges
due to SOX implementation depends on the size of the firm.
0.657
17.5
Small firms and large firms are not equally likely to consider lack of
sufficient guidance from external auditors as one of the most significant
challenges due to SOX implementation. A firm’s opinion whether lack of
sufficient guidance from external auditors is one of the most significant
challenges due to SOX implementation depends on the size of the firm.
0.417
17.6
Small firms and large firms are not equally likely to consider controls
identification and testing as one of the most significant challenges due to
SOX implementation. A firm’s opinion whether controls identification and
testing is one of the most significant challenges due to SOX
implementation depends on the size of the firm.
0.182
17.7
Small firms and large firms are not equally likely to consider cost of the
project and its efficiency as one of the most significant challenges due to
Sarbanes-Oxley implementation.
0.004
18.1
Small firms and large firms are not equally likely to expect remediation
0.834
32
efforts (process improvements) in the area of security controls to comply
with SOX.
18.2
Small firms and large firms are not equally likely to expect remediation
efforts (process improvements) in the area of IT controls to comply with
SOX. Process improvements in the area of IT controls to comply with
SOX depend on the size of the firm.
0.686
18.3
Small firms and large firms are not equally likely to expect remediation
efforts (process improvements) in the area of financial process
improvements to comply with SOX. Process improvements in the area of
financial process improvements to comply with SOX depend on the size of
the firm
0.972
18.4
Small firms and large firms are not equally likely to expect remediation
efforts (process improvements) in the area of audit committee oversight to
comply with SOX. Process improvements in the area of audit committee
oversight to comply with SOX depend on the size of the firm.
1.000
18.5
Small firms and large firms are not equally likely to expect remediation
efforts (process improvements) in the area of fraud programs to comply
with SOX. Process improvements in the area of fraud programs to comply
with SOX depend on the size of the firm.
1.000
18.6
Small firms and large firms are not equally likely to expect remediation
efforts (process improvements) in the area of internal audit effectiveness to
comply with SOX. Process improvements in the area of internal audit
effectiveness to comply with SOX depend on the size of the firm.
0.276
19.1
The boards of small firms and large firms are not equally likely to institute
corporate governance policy guideline reforms related to SOX. Instituting
corporate governance guideline policy reforms is dependent of the size of
the firm.
0.809
19.2
The boards of small firms and large firms are not equally likely to institute
reforms in board approval of non-audit services by company auditors.
Instituting corporate governance reforms concerning board approval of
non-audit services by company auditors is dependent of the size of the firm.
0.533
19.3
The boards of small firms and large firms are not equally likely to institute
corporate governance reforms concerning the establishment of whistleblower policies. Instituting corporate governance reforms concerning the
establishment of whistle-blower policies is dependent of the size of the
firm.
0.256
19.4
Instituting corporate governance reforms concerning CEO/CFO financial
0.032
33
statement certification is dependent of the size of the firm.
19.5
The boards of small firms and large firms are not equally likely to institute
corporate governance reforms concerning additional reviews of financial
statements by the board and/or audit committee. Instituting corporate
governance reforms concerning additional reviews of financial statements
by the board and/or audit committee is dependent of the size of the firm.
0.773
20.1
Small firms and large firms are not equally likely to have increased board
compensation since SOX. An increase in board compensation is dependent
of the size of the firm.
0.001
20.2
Small firms and large firms are not equally likely to have increased the
retainer since SOX. An increase in the retainer is dependent of the size of
the firm.
0.605
20.3
Small firms and large firms are not equally likely to have increased the
board’s cash compensation since SOX. An increase in the board’s cash
compensation is dependent of the size of the firm.
0.724
20.4
Small firms and large firms are not equally likely to have increased the
board’s equity compensation since SOX. An increase in the board’s equity
compensation is dependent of the size of the firm.
0.849
20.5
Small firms and large firms are not equally likely to have increased the
audit committee’s compensation since SOX. An increase in the audit
committee’s compensation is dependent of the size of the firm.
0.174
34
Appendix
Sarbanes-Oxley Questionnaire
Thank you for responding to this brief survey on the impact of Sarbanes-Oxley. This survey, prepared by Stetson University faculty,
should take no more than 4-5 minutes to complete. While your responses will be totally anonymous, this data will provide valuable
information on Sarbanes-Oxley. When complete, please return the survey in the postage paid envelope. If you would like to receive a
copy of our results, please send an email to [email protected]. Thank you very much for your participation.
How much are your annual revenues (most recent fiscal year)?
 Less than $100 million
 $101 million to $250 million
 $251 million to $500 million
 $501 million to $750 million
 $751 million to $1 billion
 Over $1 billion
Approximately how many employees does your firm employ? ___________________
How many people are on your internal audit staff? _____________________________
Is your company:
 Public
 Private
 Not-for-profit
What is your position with this firm?
 Member of board of directors
 CEO
 CFO
 Other (please indicate) _____________________________________________
What do you think has been the overall impact of Sarbanes-Oxley on your firm? (mark one response only)
 Very minor
 Minor
 Neither minor nor major
 Major
 Very major
What has been the impact of Sarbanes-Oxley on your corporate culture? (mark one response only)
 Very positive impact
 Positive impact
 No impact
 Negative impact
 Very negative impact
Has your firm instituted new rewards or sanctions related to Sarbanes-Oxley reporting? (mark as many responses as applicable)
 Yes, rewards related to positive performance on SOX reporting
 Yes, sanctions related to unethical behavior or poor performance on SOX activities.
 Neither
How much influence has public opinion had on your implementation of Sarbanes-Oxley? (mark one response only)
 Very minor
 Minor
 No influence
 Major
 Very major
Your firm’s compliance with Sarbanes-Oxley has been: (mark one response only)
 An unnecessary burden
 A necessary cost
 Will improve our company
How much of your firm’s time have been dedicated to Sarbanes-Oxley? (mark one response only)
 Very limited amount of time
 Limited amount of time
35



Moderate amount of time
Large amount of time
Very large amount of time
For your firm, the potential benefits relative to costs of implementing Sarbanes-Oxley has been: (mark one response only)
 Benefits exceed costs
 Breakeven
 Costs exceed benefits
Since the implementation of SOX, our corporate board’s legal exposure or obligation has: (mark one response only)
 Increased significantly
 Increased moderately
 No change in legal exposure
 Decreased moderately
 Decreased significantly
What is now the role of your external auditor? (mark one response only)
 Provides repository tools and facilitates throughout the compliance process
 Counsel and advise during the process
 No help until the external audit is performed
 Other (please indicate) _______________________________________________
At what stage in the Sarbanes-Oxley process is your firm? (mark one response only)
 Complete compliance
 Assessment
 Remediation
 Testing
 Documentation
 Combination of the above
 Other (please indicate) ____________________________________________
Due to implementing Sarbanes-Oxley, our firm expects to make improvements in: (mark as many responses as applicable)
 Risk identification and assessment
 Financial reporting
 Internal audit
 Compliance management
 IT (security, strategy & implementation, oversight, operations)
 Risk mitigation processes
 Control documentation and testing
 Updating governance procedures
 Strengthening code of conduct/ethics
 Updating or adding “whistleblower” policies
 Other (please indicate) _____________________________________________
The most significant challenges to our firm due to Sarbanes-Oxley implementation are: (mark as many responses as applicable)
 Insufficient resources and/or time constraints
 Documentation issues
 Lack of definitive standards
 Size or complexity of our organization
 Lack of sufficient guidance from external auditors
 Controls identification and testing
 Cost of the project/efficiency
 Other (please indicate) ____________________________________________
What areas do you expect remediation efforts (process improvements) to comply with Sarbanes-Oxley? (mark as many as applicable)
 Security controls
 IT controls
 Financial process improvements
 Audit committee oversight
 Fraud programs
 Internal audit effectiveness
 Other (please indicate) _________________________________________________
What corporate governance reforms has your board instituted related to Sarbanes-Oxley? (mark as many responses as applicable)
 Corporate governance policy guidelines
 Board approval of non-audit services by company auditors
 Establishment of whistle-blower policies
36



CEO/CFO financial statement certification
Additional reviews of financial statements by the board and/or audit committee
Other (please indicate) _________________________________________________
How has board compensation changed since Sarbanes-Oxley? (mark as many responses as applicable)











Compensation has increased
Retainer has increased
Cash compensation has increased
Equity compensation has increased
Audit committee have received increased compensation
Compensation has decreased
Retainer has decreased
Cash compensation has decreased
Equity compensation has decreased
Committee chairs have received increased compensation
Other (please indicate)
__________________________________________________
THANK YOU VERY MUCH FOR YOUR HELP!
37